What is Managed Penetration Testing?

Penetration testing is an important part of any good cybersecurity strategy. But with its limitations becoming increasingly apparent, it’s time we explored a more powerful, supercharged approach.

Let’s go off-topic for just a moment. 

Think about buying and selling homes in the UK. Over the past few years, have you noticed that there’s a growing trend for sellers to get surveys done of their own properties? Why are they voluntarily paying out for a service that’s not mandatory as part of the standard selling process?

It’s simple. 

They want to find out what issues their property has before their buyers do. This way, they can be prepared, and will have an opportunity to identify and fix issues before the buyer’s surveyor finds them.

Why are we talking about this? Because this is exactly how you feel about your business’s IT systems, right? You want to know where your vulnerabilities lie, before they can be found by someone else.

Luckily, there’s a way to do this: penetration testing.

Penetration testing for businesses

Penetration testing – or ‘pen testing’ – involves carrying out safe, simulated attacks on business systems. It’s handled by professionals, who view your network through the eyes of a cyber criminal. They know exactly what hackers are looking for, and attempt to find ‘open doors’ that enable access to your most valuable and sensitive data. With everything written up in a report, businesses have the opportunity to close, seal, and lock these doors before real attackers have the chance to find them.

Sounds great, doesn’t it?

Why, then, aren’t more businesses doing it?

The government’s 2022 Cyber Security Breaches Survey found that 14% of UK businesses were embracing pen testing. Surprisingly, just one year later, that figure had fallen to just 11%.

While it’s possible there are many reasons for the decline, pen testing limitations are a likely cause.

Exploring the limitations

The National Cyber Security Centre has some excellent guidance on penetration testing. And we want to share two very interesting pieces of text that you’ll find within this NCSC guide:

1. Penetration testing provides ‘confidence that the products and security controls tested have been configured in accordance with good practice, and that there are no common or publicly known vulnerabilities in the tested components, at the time of the test’. 
2. ‘A penetration test can only validate that your organisation’s IT systems are not vulnerable to known issues on the day of the test’. 

Notice anything interesting? 

‘At the time of the test’ and ‘on the day of the test’ are absolutely key statements here. Pen testing provides a very brief snapshot of your security position in that precise moment. But things are always changing. Weeks later, days later, or even hours later, who’s to say your position is still the same?

That’s the thing. We just don’t know. 

Does this mean pen testing is pointless? No. Far from it. The insight it can provide can be incredibly beneficial to businesses looking to improve their security. We just need to approach it differently. 

That’s where managed penetration testing comes in. 

Managed pen testing

On the whole, managed pen testing is very similar to standard pen testing. In fact, the activities used to assess system security and check for vulnerabilities and weaknesses will be pretty much the same.

The difference comes in how the testing is carried out. 

Standard pen testing is typically a standalone event carried out annually. Managed pen testing, on the other hand, is an organised service which routinely attempts to locate areas within your network that could be exploited. It’s designed to help businesses maintain their security all year round. 

Imagine a new security vulnerability emerges the day after penetration testing. Under a standard programme, this vulnerability may not be identified for an entire year. That’s 12 months of your network potentially being exposed to criminals. With managed pen testing, that new vulnerability may only remain for a few weeks before it’s identified, giving you the opportunity to fix the issue before anyone with malicious intent manages to uncover it. It’s eyes on your network, all the time. 

Pen testing vs. managed pen testing

Penetration testing offers:

• Threat simulations
• Infrastructure testing
• Application testing
• Network testing
• Vulnerability identification

Managed penetration testing offers:

• Threat simulations
• Infrastructure testing
• Application testing
• Network testing
• Vulnerability identification
• Ongoing monitoring
• Recurring insight
• Constant updates to vulnerability data
• Opportunities for continual improvement

It’s clear to see which is the preferred option, isn’t it?

Real-time insight into business security

Penetration testing offers powerful insight into your security posture at a given point in time. Managed penetration testing offers powerful and ongoing insight into your security posture. If the managed solution sounds better to you, contact us to find out more about it.