Skip to main content
Resource library

Penetration Testing Resources: Everything we have learned from testing other people's software

Customer case studies with the numbers left in, the research behind each detection engine, version-by-version release notes, the webinar slate, and the templates our own team uses. No lead-capture wall on anything that does not need one.

Resources published
21
Customer case studies
6
Downloadable resources
4
Latest release
5.2.14

Latest case study

What changed for a team that stopped testing twice a year

6 studies in total, each with the challenge, the approach, the numbers and the lesson that transfers.

Product news

What shipped, and the detail behind it

Updates explain what changed and why it matters. Release notes list every feature, improvement and fix, version by version.

v5.2

February 12, 2026

Detection

Business logic testing, as a first-class scan type

Twenty-nine abuse patterns (race conditions, IDOR, price manipulation, workflow bypass) now run as their own scan phase, against the class of business logic flaw that has no CVE and no signature.

  • 29 business logic abuse patterns
  • Race condition detection with controlled concurrency
  • IDOR testing across authenticated identities
  • +1 more
Read: Business Logic Testing Update
All product updates

Latest release

5.2.14

February 12, 2026

Business logic testing

Twenty-nine abuse patterns make business logic testing a first-class scan phase across web app flows, alongside a substantially expanded set of SAST rules, then a run of patch releases hardening that phase and the reporting behind it.

Features
7
Improvements
8
Fixes
9
Read the release notes

Downloads

Take something with you

Checklists, templates and guides for testing, API security and running an assessment programme. Whether an asset asks for an email is stated on the row, before you click.

  • Web Application Access Control Testing Checklist

    Role combinations to test, what cross-access to attempt, what a failure looks like. Genuinely useful to any team regardless of tooling.

    Checklist · PDF and Markdown · No sign-up needed

    Download the web application access control checklist

  • API Security Testing Checklist

    Spec-driven coverage, object-level authorisation, GraphQL introspection concerns, gRPC, token scope verification, response content inspection.

    Checklist · PDF and Markdown · No sign-up needed

    Download the API security testing checklist

  • Vulnerability Assessment Programme Template

    Scope definition, cadence by asset criticality, roles and responsibilities, severity handling, acceptance workflow, evidence retention.

    Template · DOCX and Markdown · No sign-up needed

    Download the vulnerability assessment template

FAQ

Penetration testing resources FAQs

What penetration testing resources does AIPTx publish?

Five collections: case studies, product updates, release notes, webinars and downloads such as checklists and templates.

Do I need to register to use the resources?

Case studies, product updates and release notes are open to read. Webinars ask you to register, which is how the session link and recording reach you, and each download states on its row whether it asks for an email.

Where can I see what changed in the latest release?

The release notes list every version with its features, improvements and fixes. Product updates explain the most important changes in terms of what they mean for your team.

Are there penetration testing checklists and templates to download?

Yes. Downloads include a web application access control testing checklist, an API security testing checklist, a sample assessment report and a vulnerability assessment programme template.

Where can I read AIPTx research and field notes?

On the AIPTx blog, which is also linked from the Resources menu.

See Your Attack Surface in Real-Time

Run a comprehensive VAPT assessment powered by advanced security tools. Get actionable findings in hours, not weeks. No credit card required.