Speaker contrasts "legacy" penetration testing with modern solutions and outlines key criteria for modern pen testing: real-time discovery alerts and integrations (platform, email, messaging), the ability to review historical tests and map techniques to systems, searchable/manipulable reporting (who tested what, when, and where), unlimited retesting to validate fixes, and predictable, budget-friendly pricing (prefer fixed pricing over per-vulnerability billing).
Chapters
We use the term legacy penetration testing because we want it to invoke this feeling of like, I'm doing something old, antiquated, there's something new that is better out there. And so when you're looking to identify a modern penetration testing solution, you need to be looking at how are you going to alert me of the discoveries you make, the risks? You know, are you doing that on a platform? Are you emailing me? Are you messaging me? Like, how do I, how do I learn of these things that you're doing in real time? How does my team integrate with that? That is important. And then can I historically look at the tests that you've done in the past? I want to maybe go back and see, hey, did this control detect something? Did it not detect something? Were you successful, were you not successful? And what systems were actually tested using that technique? And then you want to know, how are you going to report that information to me? Can I manipulate that information and search for that information? How easy is it for me to get an understanding of what, what was done by whom and at what time and against what systems? And most importantly, unlimited retesting. You're going to go fix these issues or discoveries that were made, your IT teams are going to fix this and you're going to want to basically know and have some sort of validation that you've corrected these things and there's no longer a risk there. So do they offer unlimited retesting and is the pricing digestible? Can, like you afford this thing? Can you budget for this type of offering? So, for example, if you are paying per vulnerability or per discovery, that's going to be hard for you to budget for. But if there is some sort of fixed pricing where you can budget and understand what does today look like, what does the future state look like as our company grows, then you can budget for that. And it's much easier to make business related decisions with your security program when you can do that.
