Meta and PortSwigger drive offensive security further to find what others miss