Speaker argues for a hybrid penetration-testing model that pairs automation with manual testing. Automation provides scalability, repeatability, and continuous coverage, while human testers handle complex or non-automatable techniques. Pen tests produce useful byproducts—attack-surface discovery (dynamic hosts), adversary simulation, purple teaming, and control-detection validation—that help prioritize resources. The speaker also emphasizes including bleeding-edge testing (recent vulnerabilities/exploits) promptly in a continuous testing program.
Chapters
We don't want to use 100% automated solutions. You rely on just 100% automated solutions. You will have gaps. Not every technique and tactic can be automated and none of it is in our current landscape. So you don't want to use 100% automated. But on the flip side, you don't want to use 100% of the manual driven as well because you need to have scalable, repeatable, continuous frameworks. You need to use a little bit of automation. So the the best answer here is the hybrid model approach where you're using automation paired with the things that cannot be automated or very complex to automated. You can bring the proven methodologies from humans and that hybrid model is the way to do it. And then you want to gain additional benefits from the penetration test. The penetration test has attack surface management, output of dynamic hosts that are discovered and how they've changed. It has adversary simulation, purple teaming, testing, validation, all those byproducts that the tester is doing anyways. You want to capture and gain some insights as to what happened. So therefore you can have the validation of hey, did my controls detect this? Did they not detect this? And you get better understanding of where to deploy resources, whether it's time or money in your organization to improve your security posture. And then lastly, you want to invoke some bleeding edge testing and techniques. Now these are the recent vulnerabilities or the just released exploits. You want to make sure that somewhere in the program those are being tested as soon as possible. Because if you have affected technology in your environment, you're going to want to know, hey, am I vulnerable to this? And so bleeding edge techniques and that testing, open door policy to test those things whenever possible. That is one of the most important things to do in a continuous penetration testing program.
