The RedTeam Security blog

A tall dark steel cabinet with five stacked glass-fronted compartments, each closed with a different padlock, and five brass keys hanging on hooks beside it, one of them carrying a red tag.

16 September 2026

Testing an API you do not operate: who authorises it, and what UAE rules still ask of you

A vendor runs the API, a cloud gateway fronts it, a partner sits downstream: who authorises the test at each layer, and what UAE regulators still ask of you.

Detection

Three brass gauges mounted in a row on a dark steel control panel, each dial reading a different value, joined behind the panel by a single red pipe that surfaces into view only at the third gauge.

15 September 2026

Gateway, identity provider or service: where an API pentest should be seen

An API is watched from three layers and none sees the whole test. Which layer records each phase of an API pentest, and the join that turns records into alerts.

Methodology

A long drafting table under a single desk lamp holding six sheets of paper laid side by side, red thread pinned between matching rows across the sheets, and one row on the last sheet circled with nothing pinned to it.

14 September 2026

How an API pentest builds its endpoint inventory: specification, traffic and the version nobody retired

How an API pentest builds its endpoint inventory: specification, gateway routes, client traffic and retired versions, reconciled into one list the test runs on.

A brass turnstile gate in a steel corridor with a mechanical counter mounted above it, a row of small brass keys hanging on hooks beside the gate, and a paper ledger lying open on a lectern recording each pass.

13 September 2026

Tokens, rate limits and logs: the UAE controls an API pentest has to evidence

The four control families every UAE instrument carries, what each asks of an API endpoint, and the evidence CBUAE, DESC, ADHICS and the IAS read from a pentest.

A steel switchboard with rows of labelled sockets, several patched with red cords running to a separate rack, and one socket left open with a brass key resting in it.

12 September 2026

What UAE regulators expect from an API pentest: open finance, supplier links and the evidence

Where an API sits under CBUAE open finance, DESC supplier rules, ADHICS and the UAE IAS, and the evidence pack an examiner reads after an API pentest.

A brass clock with a red second hand mounted above a heavy steel door, and beneath it a dark desk holding a sealed red envelope and a telephone handset lifted off its cradle.

11 September 2026

Does a detected Red Team start the UAE incident reporting clock? What to settle before day one

When your SOC catches a Red Team, does the UAE incident reporting clock start? What CBUAE, DESC, ADHICS and the IAS expect, and what to settle before day one.

Detection

A dark corridor floor crossed by a single taut red thread at ankle height, anchored to two small brass pegs, with a steel key and a sealed folder lying just beyond it under a narrow beam of light.

10 September 2026

The tripwires a Red Team should hit: honey accounts, canary files and decoy records

The tripwires a Red Team should trip on the way to the objective: honey accounts, canary files and decoy records, how each is scored, and what to lay first.

A folded letter under a red wax seal on a dark desk, a fountain pen laid across it, a brass key and a blank access card beside it, and a red thread running from the seal to a small steel door standing at the desk's edge.

9 September 2026

Authorising a Red Team under UAE law: the letter, and what it cannot cover

What a Red Team authorisation letter must say under UAE law, who has the authority to sign it, and what no client can authorise: third parties and real brands.

Detection

A dark console holding a row of brass signal lamps, one lit green among unlit ones, with a brass stopwatch beside them and a red thread running past the lamps to a small steel vault at the far end.

8 September 2026

What your SOC should catch during a Red Team engagement

What a SOC should detect in each phase of a Red Team engagement, what to do when analysts catch the operators, and how each step is scored.

A leather-bound ledger open on a dark desk beside a wax-sealed envelope and a brass drafting compass, with a red thread pinned across a folded floor plan leading to a small steel vault at its centre.

7 September 2026

The UAE rules that expect a Red Team, and the evidence they read

Which UAE regimes expect a Red Team engagement, what a supervisory expectation means in practice, and the evidence pack an examiner reads afterwards.

Methodology

A brass and dark steel control panel of routed channels and gates, one channel curving around a closed gate instead of passing through it, with a single lever left standing in the raised position.

6 September 2026

How to test business logic flaws in a web application

Business logic flaws use your application exactly as built. How to model the rules, run the abuse cases and prove the outcome in a web app pentest.

Methodology

A grid of blank square cards pinned in rows and columns on a board, some cells left open and others closed with a small latch, two keys of different sizes lying across separate rows.

5 September 2026

How to test authorisation in a web application, role by role

How authorisation is tested role by role in a web application pentest: the role matrix, the three-identity replay, and what a finding has to show.