The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
Hospital Network Security: 4-Site Case
A flat /16 network spanning four hospitals reorganised into 12 VLANs with host-based microsegmentation and EDR rollout. Lateral-movement contained in red-team test.
VAPT Case Study India: NBFC Pre-IPO
A CERT-In-aligned web + API + network VAPT engagement on a tight 90-day pre-IPO timeline. 23 findings, 6 weeks to closure, RBI inspection passed.
Active Directory Hardening: Critical Case
A password-spray attack from 80+ source IPs compromised three service accounts. We rebuilt the AD trust model, deployed Defender for Identity, and implemented conditional access. Twelve months on: zero successful sprays.
API Security Testing: Healthtech Case Study
A healthtech startup's APIs had grown faster than their auth model. We pen-tested, refactored OAuth, added rate limiting and schema validation. 18 high/critical findings closed; p99 latency improved.
Cyber Insurance Readiness: 60-Day Case
A 200-person manufacturer received a renewal denial unless seven specific controls were in place within 60 days. We delivered all seven, ran a tabletop, and the underwriter approved at 18% lower premium.
Bug Bounty Program Launch: SaaS Case Study
A B2B SaaS founding team wanted external security feedback but feared scope creep, payout sustainability, and triage overhead. We designed and launched their HackerOne private program — 14 valid findings in the first 90 days, budget held.
WordPress Incident Response: 90-Min Case
A direct-to-consumer brand discovered an attacker exfiltrating order data through a compromised admin account. We contained the incident in 90 minutes from notification and walked away with a hardening brief the client actually adopted.
Bug Bounty Challenges: 10 Critical Realities
The honest list of problems bug hunters deal with — duplicates, slow triage, severity disputes, scope creep, payout inconsistency, burnout, and the legal gray zones — with practical mitigations.
Bug Bounty Hunting 2026: Beginner Roadmap
A focused 90-day roadmap for new bug bounty hunters in 2026 — what skills to build, which platforms to start on, the tools you actually need, and how to write a report that gets paid.