Hackup's

For most of my career, security testing sat in a separate room. QA checked that features worked, and once or twice a year a security team or an outside firm ran a penetration test, handed over a PDF, and left. Everything found in that PDF was expensive to fix, because it had been in production for months. That model does not survive weekly releases. After 11 years in software testing and QA leadership, I am convinced the biggest untapped security resource in most teams is the QA engineer who already knows every screen, every role and every edge case. You do not need to become a penetration tester. You need a few habits, one free tool and a handful of automated checks. This guide is the starter kit I wish I had been given. Everything here is defensive and meant for applications you own or are explicitly authorised to test. Why Security Belongs in Your Test Plan Security bugs are bugs. A user who can open another customer's invoice by changing a number in the URL is a funct...

The last time I wrote on this blog, a phishing email gave itself away with bad grammar, a strange sender address and a "Dear Customer" greeting. That was 2015. Today the same scam can arrive in flawless English, quote your manager's name, and be followed by a phone call in a voice that sounds exactly like someone you trust. Hackup's is back, and I can't think of a better comeback topic. AI has made scams cheaper, faster and far more convincing. The good news is that the defence is still simple, as long as you change what you look for. I've spent the last 11 years in software testing and QA leadership. My job is to assume something is broken until it proves otherwise. That habit, it turns out, is the best anti-scam tool I know. Let me show you how to use it. Why AI Phishing Is a Different Game in 2026 The numbers are moving in the wrong direction. The Anti-Phishing Working Group's Phishing Activity Trends Report for Q2 2026 fo...