A penetration test is a simulated attack on a computer system, network or application to expose security weaknesses before real attackers can exploit them. Instead of waiting for a real breach, this vulnerability exercise tests a business’s existing security controls and, in doing so, identifies where defences might be falling short.
While penetration testing is important, Nithen Naidoo, founder and CEO at Snode Technologies, believes it doesn’t go far enough. “This kind of assessment often lacks context around the asset you are trying to protect and the threat you’re trying to defend against.”
According to him, this is where exposure management can add real value. Where penetration testing provides a list of vulnerabilities, threat exposure management considers what value an asset holds for a specific business. It also factors in the unique threat landscape based on the business’s particular industry, location or current geopolitical circumstances. “Exposure assessments are different in that you’re not just looking at the weaknesses of systems; you are looking at the weaknesses of people and processes, while also taking statutory and regulatory requirements into consideration.”
The goal is to hone in on that list of vulnerabilities and highlight the one or two that matter most because they have greater potential to cause financial loss or reputational harm. “This isn’t to say that penetration tests don't hold value. Running a penetration test is part of a threat exposure assessment. But it’s not enough. Additional gaps exist between where your security is today and where it needs to be. To understand these gaps, businesses need a risk-based assessment across the entire attack surface.”
Naidoo cites scope as another limitation of penetration testing. “If the scope of the test only falls within the ray of light visible to us, there’s a high chance that other vulnerabilities lie in the darkness that we cannot see. Here, I am talking about shadow IOT, shadow AI and shadow networks,” he says. “I had a meeting with someone the other day, and while we were talking, I could see his watch connecting to the corporate network. His watch has no security controls or anti-virus. The same goes for the office printer or the TV in the boardroom. These assets all connect to the network, but do they fall into the scope of an assessment?”
An attacker only needs to identify one vulnerability, but as a defender you need to be thinking about everything, which is why it is so important to use the right tools for the situation. “If you’re doing surgery, you need a surgical blade, but you aren’t going to use that same blade to butter your toast,” he says.
“Back in the day, you went to a consultant, and the consultant told you what your risk was. That was their opinion, based on limited data and their biases. But as the risk landscape has evolved, this conversation has changed. We have more data at our disposal, and we have tools to analyse it more seamlessly. Now, we can use this data to make remediations by looking at the bigger picture, which allows us to identify and address real, quantifiable risks.”
Share
