About

SecurityReport.io2 min read

SecurityReport.io publishes security buying guides for small businesses, small medical practices, small defense subcontractors, small retailers, and the consultants and one-person IT departments who support them.

The pieces are decision and comparison guides: which control a tool actually covers, what it costs for a 12-person office, and when the free option is the right one. Mapping a HIPAA safeguard, a NIST 800-171 practice, or a cyber-insurance question to a specific product takes practitioner knowledge. That is the work this site is for.

The publisher

SecurityReport.io is published by Matt Moreschi, a cofounder of Brackish Security and the founder of Inject. The site is his own and is not run by either company.

Matt works in offensive security: penetration testing of external and internal networks, web and mobile applications, APIs, IoT devices and wireless networks, along with source code review, red and purple teaming, and phishing and vishing (phone phishing) assessments. He has worked for large and small consultancies, enterprise and healthcare organizations, and a FAANG company.

Certifications

OSEP, OSWE and OSCP, OffSec's penetration testing certifications
Rapid7 InsightVM Certified Administrator

Recognition

2023 Department of Defense Researcher of the Year (DC3 annual report)
2024 State of California Top 25 Researcher (write-up)
Bug bounty profiles on Bugcrowd and HackerOne, and code on GitHub

CVEs

A CVE (Common Vulnerabilities and Exposures) ID is the public identifier for a disclosed security flaw. Matt is credited on CVE-2021-35959, CVE-2021-35196, CVE-2021-44255, CVE-2022-25568, CVE-2022-35122, CVE-2022-43263, CVE-2022-43264, CVE-2023-24080, CVE-2023-24081, CVE-2023-28627, CVE-2025-46346, CVE-2025-46347, CVE-2025-46348 and CVE-2026-55488. CVE-2023-27109, an SQL injection in the Eufy Security app, was assigned and later dropped from the public list (write-up).

Elsewhere

Matt's personal blog is pizzapower.me. Other sites in the same network are TechReport.io, for tech and gear reviews, and BrickReport.io, for LEGO set reviews.

How the site is paid for

Some links are affiliate or referral links. If you buy or sign up through them, we may earn a commission, at no extra cost to you. Commission never decides the recommendation. The details are on the affiliate disclosure.

How a guide is written

Hands-on findings are labeled separately from documentation-based analysis. A control mapping or a setup guide for a small office does not pretend to be a year in production. The rules are on how we write.