Netragard

Name: Netragard
Address: 11 Apex Drive, Suite 300A, Marlborough, MA, 01752, US
Telephone: +18572640980
Price range: $

We protect you from people like us. Netragard, Inc is a research driven Network Pe*******on Testing firm.

Our pe*******on testing deliverables are guaranteed to be free of false positives and the product of expert driven research. If we deliver a pe*******on testing report that contains even a single false positive, we will deliver the next test free of charge.

10/13/2026

An obfuscated password isn’t necessarily a protected password.

During a recent assessment, we found SQL Server credentials stored in a Lobster Data configuration file using the OBF: format. Jetty’s standard decoding utility couldn’t recover the password, so we dug into the application’s Java libraries.

After reverse engineering the custom obfuscation routine, we built “Lobster Pot” - a standalone Python tool to recover the plaintext password. 🦞

Those credentials helped enable lateral movement and privilege escalation, ultimately leading to a Domain Admin foothold.

Our latest post breaks down the discovery, the reverse engineering, and why obfuscation fell short.

Read “Reverse Engineering Password Obfuscation in Lobster Data Configuration Files”:
https://netragard.com/blog/reverse-engineering-lobster-data-password-obfuscation/

*******onTesting

Learn how Netragard reverse engineered password obfuscation in Lobster Data to recover stored credentials and expose weak credential protection.

09/28/2026

OpenAI’s agent breached an Australian government health portal.

The headlines call it “rogue AI.”

That’s not what happened.

The model used the tools, access, and permissions humans gave it. The real failures were weak detection at the target and an AI harness with no meaningful guardrails.

AI-driven attacks are not magic. They are noisy, detectable, and preventable—if organizations and AI vendors implement the controls that already exist.

We break down what actually happened, why the “rogue AI” narrative is dangerous, and who should be accountable.

Read the full analysis:

OpenAI's AI agent breached the Australian Medicare portal. The AI didn't go rogue. The victim had weak security and OpenAI had a sloppy harness. Here's the truth.

09/21/2026

Netragard Founder and CEO, Adriel Desautels, was recently featured in Business Insight discussing a mistake that continues to leave businesses exposed: confusing cybersecurity compliance with actual security.

Passing a SOC 2, ISO 27001, or PCI DSS audit is important. But an audit does not prove an attacker cannot get into your environment.

Attackers are not following a checklist. They are looking for the weak authorization boundary, exposed service, overprivileged account, overlooked vendor connection, or trust relationship that can be turned into a path to sensitive data.

AI makes that problem more urgent not necessarily because every AI-driven attack is sophisticated, but because automation can help attackers probe systems, test combinations, and move faster when security fundamentals are weak.

In our latest article, we expand on Adriel’s comments and examine:
1️⃣Why compliance should be a security baseline, not the complete strategy
2️⃣The difference between automated vulnerability scanning and manual adversarial testing
3️⃣How attackers chain seemingly separate weaknesses into a viable path to compromise
4️⃣Why threat intelligence needs to be contextualized around your organization’s critical assets
5️⃣How AI accelerates familiar security failures rather than replacing the need for fundamentals

❌The most useful question is not whether your organization passed its last audit.

✅It is: What happens when someone tries to break in?

Check it out: https://netragard.com/blog/why-ai-driven-attacks-exploit-the-cybersecurity-compliance-gap/

AI-driven attacks expose the gap between cybersecurity compliance and real security. Learn why testing real attack paths matters more than passing audits.

08/26/2026

Different systems face different threats and a one-size-fits-all pe*******on test can leave critical attack paths untested.

Our new guide covers the major types of pe*******on testing, from networks, web apps, APIs, and cloud environments to wireless, mobile, IoT, physical security, and social engineering.

It also explains why the difference between a vulnerability scan and genuine human-driven testing matters. A scan may identify potential issues. A real pe*******on test shows whether those weaknesses can be exploited, chained together, and used to reach sensitive systems or data.

Read the guide to learn which testing approach best aligns with your organization’s real-world attack surface: https://netragard.com/blog/types-of-pe*******on-testing/

*******onTesting

Learn about the different types of pe*******on testing that can be performed to secure your digital operations based on target, tester knowledge, and scope.

08/21/2026

Most pe*******on test reports don’t create meaningful security improvements - they get filed away after a compliance checkbox is checked.

A real report should show more than a list of vulnerabilities. It should explain how an attacker could move through your environment, what they could access, where defenses failed, and exactly what actions will disrupt that path.

Our latest article breaks down what to look for in a pe*******on test report, including:

1️⃣The difference between a real attack-path narrative and scanner output
2️⃣Why CVSS scores alone don’t tell you your actual business risk
3️⃣How to identify generic remediation advice
4️⃣What effective remediation, ownership, and retesting should look like

If the report has no documented Path to Compromise, no environment-specific findings, and no clear plan to validate fixes, it may be a vulnerability assessment, not a true pe*******on test.

Read the full post: https://netragard.com/blog/how-to-interpret-pe*******on-test-results/

*******onTesting

Learn about the essential components within a pe*******on test report and how best to take action on the results to ensure IT security and regulatory compliance for your organization.

08/04/2026

Was the OpenAI / Hugging Face incident really “rogue AI”?

Short answer: no.

In my new blog, “AI Didn’t Go Rogue: How OpenAI’s Harness Failed and Turned Hugging Face into Collateral Damage,” I walk through the attack like a red team engagement and explain:

Why the incident was a containment and architecture failure, not machine “intent”

What this means for anyone using AI agents in real environments

If you care about practical AI security — not hype — this breakdown is for you.

👉 Check it out here:

A real red team operator dissects the OpenAI–Hugging Face incident, showing it was a harness and containment failure - not rogue AI - and how similar issues are emerging across the industry, including Anthropic.

07/21/2026

Weak encryption can make credentials look protected when they really aren’t.

In a new Netragard blog post, we break down a FaciliWorks deployment where the credential “encryption” was simple enough to reverse, exposing plaintext SQL and application passwords. The focus is on how the protection worked, how it was broken, and the broader lessons for securing credentials.

In the article, we walk through:
1️⃣How credentials were stored in the app and database
2️⃣The custom cipher used to “protect” them
3️⃣How that design exposed plaintext passwords
4️⃣What this means for real‑world risk and hardening

If you care about how applications actually protect your credentials under the hood, this is worth a read.

👉 Check out the full post:

Netragard pe*******on testers demonstrate how weak encryption in FaciliWorks allows attackers to recover plaintext credentials, exposing serious enterprise risk.

07/17/2026

“How often should we run a pe*******on test?”

Most people expect a simple answer like “once a year” or “quarterly,” but real security doesn’t work on a one-size-fits-all calendar.

In our new blog, we walk through how to:
1️⃣Set annual + post-change testing as a baseline
2️⃣Layer in ad-hoc tests after major releases, incidents, or infrastructure changes
3️⃣Combine deep manual testing with continuous automated scanning / PTaaS for real coverage
4️⃣Align your cadence with PCI, SOC 2, HIPAA, GDPR, GLBA, DORA and other requirements without turning it into a box-checking exercise

Read the full article: https://netragard.com/blog/pe*******on-testing-frequency/

*******ontesting

Explore best practices for how frequently your organization should be conducting pe*******on testing based on industry, compliance needs, and other factors.

07/02/2026

It's no secret we feel the industry has done the customer a disservice by abandoning real quality standards for pe*******on testing, and by passing off automated scanners and AI-generated output as genuine pen testing.

So when we get the chance to sit down with veterans who actually get it, we take it.

Our founder and CEO, Adriel Desautels, joined the Enterprise Security Weekly podcast (ESW #465) on SC Media this week for a candid conversation about the state of pe*******on testing — why it hasn't meaningfully moved the needle for security teams in 20 years, and why layering AI on top of a broken model won't fix it.

But the conversation didn't stop at the problems. Adriel also shared some very practical and not expensive ways organizations can meaningfully improve their security posture right now, regardless of budget.

If you're tired of pen test reports that look impressive but don't actually help you get more secure, this one is worth your time.

Listen here: https://www.scworld.com/podcast-segment/14920-fixing-pentesting-meta-is-destroying-its-engineering-org-the-weekly-news-adriel-desautels-esw-465

*******onTesting

Interview with Adriel Desautels – the pentest is broken. Adriel joins us for a discussion on the state of pe*******on testing, why it hasn’t done much to help security teams over the last 20 years, and why AI won’t save it. Segment Resources: https://hbr.org/2026/04/boards-are-falling-short-on...

06/17/2026

Big security budget. All the “right” tools. Clean audits.
And then a single compromised account or cloud misconfiguration leads to a major incident.

The issue isn’t just how much you spend - it’s what you’re buying, and whether it’s been tested against realistic attack paths.

Adriel’s new article breaks down:
✅Why tools and compliance alone aren’t enough
✅How attackers move through environments
✅How human-led testing makes every security dollar count

👉 Big Security Budgets, Still Easy to Hack

Learn why tools and compliance aren’t enough and how adversary-driven testing makes your security spend truly count.

Address

11 Apex Drive, Suite 300A
Marlborough, MA
01752

Telephone

+18572640980

Website

http://www.netragard.com/

Alerts

Be the first to know and let us send you an email when Netragard posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Netragard: