Pentevo Blog
Learn cybersecurity, the practical way.
Tutorials, ethical-hacking guides, CVE breakdowns and attack analysis — written in plain English by people who build security tooling. New posts regularly.
EU Cyber Resilience Act (CRA) Explained: Who It Affects and What It Requires
The CRA applies to all products with digital elements sold in the EU. Essential requirements, SBOM mandate, 24-hour vulnerability reporting, and the December 2027 deadline.
August 6, 2026
by Pentevo
What Is an ISMS? ISO 27001 Information Security Management System Explained
An ISMS is the documented management system ISO 27001 requires. Clauses 4–10, the 93 Annex A controls, the Statement of Applicability, and how it maps to NIS2 Article 21.
August 6, 2026
by Pentevo
NIS2 Explained: Who Is Affected, What You Must Do, and by When
NIS2 in practice — Annex I and II sectors, size thresholds, essential vs important entities, the ten Article 21 measures, the 24/72-hour reporting cascade, and management liability.
August 6, 2026
by Pentevo
SBOM Explained: Software Bill of Materials, Formats, and Why the CRA Requires One
What an SBOM is, what belongs in one, CycloneDX vs SPDX, how to generate and maintain one, and exactly what the EU Cyber Resilience Act mandates.
August 6, 2026
by Pentevo
KRITIS Explained: Germany's Critical Infrastructure Security Requirements
A practitioner's guide to KRITIS — the legal basis, which sectors and thresholds apply, what §8a BSIG demands, how the KRITIS-Dachgesetz adds physical resilience, and what BSI inspectors look for.
August 3, 2026
by Pentevo
PSIRT: What It Is and How to Build One (Complete Guide)
Learn what a PSIRT is, how it differs from a CSIRT, what the FIRST PSIRT Services Framework requires, and how to build a product security incident response team from scratch — including CRA Art. 13 and Art. 14 obligations.
August 3, 2026
by Pentevo
TISAX Explained: Automotive Information Security Assessment for Suppliers
A practitioner's guide to TISAX — the VDA-backed assessment exchange that automotive suppliers must pass to handle OEM information. Covers labels, assessment levels, VDA ISA domains, costs, and how TISAX compares to ISO 27001.
August 3, 2026
by Pentevo
Want to go deeper?
Our free Academy covers 100% of the CEH exam with narrated lessons and spaced-repetition review.
Browse free courses