As part of their overall risk management efforts, many South African organisations commission a penetration test just once a year. They receive a report, close the high-severity findings and file the document for the auditors. Then, for the next 11 months, they behave as if that report still describes their environment.
It doesn't.
Enterprise environments are constantly changing, and cyber risk is evolving faster than ever before. Modern risk is a moving and constantly changing target, and once-off annual snapshots simply don’t show enough of the changing picture for organisations to mitigate risk effectively.
The World Economic Forum Cyber Security Outlook for 2026 notes AI is “supercharging the cyber arms race”, with artificial intelligence/machine learning, cloud technologies, quantum technologies, autonomous systems and decentralised technologies among the technologies expected to have the most significant effects on cyber security this year.
In many cases, a clean report gets treated as an assurance statement, when it is really a dated observation.
At the same time, South African enterprise environments are changing and maturing fast. PwC says over 80% of South African enterprises already rely on cloud services, and 88% plan to increase their cloud budgets − in many cases to support AI and analytics. Today’s enterprise environment looks very different from the way it did a year ago.
South Africa has a proud tradition of relatively early technology adoption, which means our enterprises are constantly integrating new technologies and rearchitecting their infrastructure to stay competitive. Things can change fast in mature enterprise environments. This means that their risk profiles change equally quickly.
A clean pentest report is not an indefinite clean bill of health. While a well-scoped penetration test by an accredited provider remains one of the most valuable investments a security programme can make, it should be noted that it is also a just snapshot that tells you how a defined scope looked to a skilled tester during a fixed window.
The day after the test ends, someone may spin up a new cloud workload, a developer might expose a test API, a supplier may be given remote access, or a staff member's credentials could turn up in an infostealer log. None of these changes were in scope, and none of them will be tested until next year.
The problem with penetration testing is the way in which many organisations use the results. In many cases, a clean report gets treated as an assurance statement, when it is really a dated observation.
Moving to CTEM
Instead of relying on once-off or annual snapshots, organisations need to move towards continuous threat exposure management, or CTEM.
The principle is simple: rather than asking ‘Did we pass?’ just once a year, organisations need to keep asking ‘What is exposed now, and does it matter?’
For boards, the question to ask is not ‘When was our last pentest?’ but ‘How would we know if our exposure changed last Tuesday?’ If nobody can answer that, the report on file is giving more comfort than it should.
That means continuously discovering what they have facing the internet, validating which exposures an attacker could genuinely use, and prioritising fixes by their potential business impact rather than severity score alone.
In practice, the annual penetration test should become just one input into a cycle, not the cycle itself. Deep manual testing is still where you find the logic flaws and chained attacks that tools miss. Continuous discovery and validation is how you make sure the environment tested is still the environment you run.
Gartner’s five-stage CTEM framework, first released in 2022, outlines a shift from traditional, periodic vulnerability scanning to a continuous cycle for managing security.
It entails an iterative loop of scoping, discovery, prioritisation, validation and mobilisation. It builds on traditional vulnerability management by covering cloud, identity risks, external attack surfaces and physical assets − all areas that can change rapidly within an organisation.
While Gartner expected CTEM to significantly reduce risk exposure, a 2026 Reflectiz study found that only 16% have adopted CTEM, although adoption is now growing. Those who have deployed the CTEM approach achieve 50% superior attack surface visibility and outperform on every threat awareness metric.
The evidence is there: CTEM is the better way to stay abreast of risk as enterprise environments change and the risk landscape evolves. Security posture is not something you achieve once. It drifts daily, and the only defence against this drift is to keep monitoring the landscape.
CTEM delivers continuous visibility, which enables leaders to support digital ambition with evidence-based decisions, creating a stronger foundation for innovation, accountability and trust.
Share
