B BROCENT

penetration testing

Cover image for Brocent IT blog post: The Report Has to Satisfy Their Bank: Penetration Testing for a Hong Kong Fintech Under Counterparty Review

September 25, 2026 | 20 min

The Report Has to Satisfy Their Bank: Penetration Testing for a Hong Kong Fintech Under Counterparty Review

For the founder or head of engineering at a 15-40 person Hong Kong fintech whose banking counterparty has made a penetration test report a condition of onboarding. Who actually reads the report and what they need to write down, the four things that make a report acceptable, how to scope the test to the relationship, why the cheapest scan fails and the biggest engagement overshoots, planning backwards from the deadline, the re-test small teams forget to negotiate, handling findings you cannot fix in time, and reusing the report for the next counterparty.

Cover image for Brocent IT blog post: Three Weeks to Launch, No Pen Test Booked

September 04, 2026 | 17 min

Three Weeks to Launch, No Pen Test Booked

A composite scenario from Hong Kong: a tech startup's public launch date is set, and someone finally asks whether the app has been pen-tested three weeks before go-live. What actually fits into the time that's left, and why the test needs to be planned against the launch date, not squeezed in after it.

Cover image for Brocent IT blog post: The Pen-Test Requirement a Hong Kong Payments Firm Didn't See Coming

September 04, 2026 | 15 min

The Pen-Test Requirement a Hong Kong Payments Firm Didn't See Coming

A composite scenario from Hong Kong: a licensed payments firm faces a routine regulatory review asking for evidence of penetration testing, and finds a two-year-old PDF isn't evidence of anything current. What a maintained testing cadence changes, and where an IT partner's role stops.

Cover image for Brocent IT blog post: How to Use Claude for Adversarial Testing of Your Own Source Code

August 12, 2026 | 11 min

How to Use Claude for Adversarial Testing of Your Own Source Code

A practical method for running an adversarial AI pass over code you own — how to frame the prompt so it finds real defects, why nothing counts until you reproduce it, and what this will never catch.

Cover image for Brocent IT blog post: How to Auto-Generate Internal API Documentation with Claude

August 11, 2026 | 10 min

How to Auto-Generate Internal API Documentation with Claude

How to build a documentation pipeline that extracts your route table deterministically, uses Claude to describe only real endpoints, regenerates on every merge — and what to do about the forgotten endpoints the first run always finds.

Cover image for Brocent IT blog post: Vulnerability Management vs. Penetration Testing: What APAC SMEs Actually Need

July 14, 2026 | 14 min

Vulnerability Management vs. Penetration Testing: What APAC SMEs Actually Need

A practical guide for APAC SMEs on the difference between continuous vulnerability management and point-in-time penetration testing, when each is required by SFC, MAS, HKMA, or PCI-DSS, and how to decide which to invest in first.