Request a quote

OverWatch Docs

Security, understood.

Practical guides for learning how systems fail, and how to make the fix hold. Browse a topic or search the full text of the library.

  • 19 field guides
  • 6 topics
  • Free to read, no sign-up

19 guides available.

Browse by topic

01Assessment foundationsDecide which assessment answers your question before you scope one.1 guide 02Application securityAccess control, workflow abuse and session handling in web applications and APIs.3 guides 03Networks & detectionInternal networks, Active Directory, and the limits of endpoint detection.4 guides 04Code & delivery pipelinesStatic analysis, manual code review, and credentials that leak through builds.2 guides 05Personal security & OPSECWhat protects you online, what does not, and where your data lingers.3 guides 06Threat intelligencePivot, validate and prioritize indicators without jumping to conclusions.6 guides

Start here

New to security assessments?

Start with the decision, not the tool. Learn which assessment fits your question, then follow an access-control example from risk to remediation. Test only in labs or with explicit authorization.

  1. 01Choose the right assessmentPentest or red team, and why it matters.
  2. 02Understand access controlThe most common serious web flaw, explained.
  3. 03Build your personal baselineAccounts, devices and everyday exposure.

Topic 01 1 guide

Assessment foundations

Decide which assessment answers your question before you scope one.

Assessment foundationsChoose a pentest or red team

Match the engagement to your question, detection maturity, and decision.

9 min readRead guide

Topic 02 3 guides

Application security

Access control, workflow abuse and session handling in web applications and APIs.

Application securityIDOR & access control

Understand account boundaries, test with two users, and verify ownership checks.

11 min readRead guide Application securityBusiness logic flaws

Recognize workflow abuse even when every individual endpoint works.

12 min readRead guide Application securitySessions, tokens & account access

Understand why protecting a password alone does not protect a session.

12 min readRead guide

Topic 03 4 guides

Networks & detection

Internal networks, Active Directory, and the limits of endpoint detection.

Networks & detectionAssumed-breach assessments

Follow the methodology from an agreed foothold to privileged access.

13 min readRead guide Networks & detectionActive Directory Certificate Services

Understand certificate-based attack paths and configuration risks.

14 min readRead guide Networks & detectionEndpoint detection limitations

Understand detection gaps and the value of controlled validation.

12 min readRead guide Networks & detectionAntivirus and layered defenses

Learn what antivirus does, what it misses, and why layers matter.

12 min readRead guide

Topic 04 2 guides

Code & delivery pipelines

Static analysis, manual code review, and credentials that leak through builds.

Code & delivery pipelinesUsing SAST in code review

Turn scanner output into findings with context, validation, and actionable fixes.

11 min readRead guide Code & delivery pipelinesSecrets in CI/CD

Trace where credentials appear in builds, logs, and deployment workflows.

12 min readRead guide

Topic 05 3 guides

Personal security & OPSEC

What protects you online, what does not, and where your data lingers.

Personal security & OPSECWhat a VPN does and does not hide

Separate network privacy from browser, identity, and account exposure.

11 min readRead guide Personal security & OPSECDeletion, backups & data traces

Understand why deleting a file is not the same as removing every copy.

12 min readRead guide Personal security & OPSECPublic exposure and dark-web claims

Assess visibility and evidence without assuming a hidden service means anonymity.

13 min readRead guide

Topic 06 6 guides

Threat intelligence

Pivot, validate and prioritize indicators without jumping to conclusions.

Threat intelligenceStart an investigation from an IP

Use a single indicator as a starting point, not a verdict.

11 min readRead guide Threat intelligenceInvestigate suspicious infrastructure

Connect domains, addresses, timelines, and source context.

12 min readRead guide Threat intelligenceValidate threat intelligence

Check source quality, freshness, and uncertainty before acting.

11 min readRead guide Threat intelligenceConnect indicators

Follow evidence-backed relationships without confusing correlation with attribution.

12 min readRead guide Threat intelligencePrioritize security alerts

Bring exposure, confidence, and operational context into triage.

11 min readRead guide Threat intelligenceReduce false positives

Investigate conflicting evidence and tune decisions without ignoring real risk.

12 min readRead guide

Put the reading to work.

Explore Forensia for threat-intelligence research, or discuss an assessment of your own environment. Guides explain the method; they do not certify a system as secure.

Discuss an assessmentExplore products