Penetration testing simulates attacks to expose exploitable weaknesses and likely business impact, supporting risk-based fixes and layered defenses.
Search across headline titles and summaries.
Background for this topic.
Penetration testing is an authorized, time-bounded simulation of attacks against defined systems, applications, networks, cloud services, or users. Testers use realistic techniques to determine whether an attacker could gain access, escalate privileges, move between systems, or reach sensitive assets—not merely whether a scanner reports a vulnerability. The results show how weaknesses can be combined and whether preventive and detective controls work in practice.
Its value depends on a clear scope and threat model: an external test may examine exposed services and authentication, while an application test may target authorization flaws, APIs, and sensitive-data handling. Testing can disrupt systems or expose real personal or operational data, so written rules of engagement, test accounts, least-privilege access, monitoring, and protected findings are essential. Organizations should assign remediation owners, prioritize exploitable paths and business impact, and retest fixes; a penetration test complements, but does not replace, continuous vulnerability management.
Weekly headline count for the current query.
A two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change. [...]
Two decades ago, pen tester Steve Stasiukonis caused a sensation by sprinkling rigged thumb drives around a credit union parking lot and following what curious employees did next. This episode looks back at the history-making event.
Two decades ago Dark Reading posted its first blockbuster — a story from a pen tester who sprinkled rigged thumb drives around a credit union parking lot and let curious employees do the rest. This episode looks back at the history-making column with its author Steve Stasiukonis, Dark Reading senior Editor Becky Bracken and Dark Reading's editor-in-chief Kelly Jackson Higgins.
Adeeb Mahmood of Evinova and Shahar Peled of Terra Security Describe TransitionContinuous pen testing has replaced static annual tests and is reshaping how Evinova, a technology company of AstraZeneca, is managing cyber risk in its fast-moving cloud environment, said Adeeb Mahmood of Evinova and Shahar Peled of Terra Security, who describe the transition.
Newly Minted Unicorn Says AI-Driven Attacks Force Shift to Continuous Pen TestingXbow has raised $120 million in Series C funding after proving its autonomous AI hacking platform can outperform human pen testers. CEO Oege de Moor says the rise of AI-driven cyberattacks is forcing enterprises to test systems continuously rather than periodically.
Bipartisan Bill Would Mandate Multifactor Authentication, Pen TestingProposed legislation that's been kicking around Congress for the last few years that aims to help bolster cybersecurity of the healthcare sector cleared a critical hurdle on Thursday. But will the bill gain enough momentum to pass the full Senate, the House and be signed into law?
Cybersecurity Researchers at ReliaQuest warn of an ongoing campaign delivered to “high-value individuals” via LinkedIn messages
5x Revenue Growth, $1B Valuation Fuel Investment in Code Security InnovationBacked by DST Global, Aikido Security’s $60 million Series B will fund global expansion and boost its AI-powered security tools. CEO Willem Delbare said the firm’s autonomous pen testing and code remediation cuts cost, boosts software resilience and already outperforms humans.
An intermittent outage at Cloudflare on Tuesday briefly knocked many of the Internet's top destinations offline. Some affected Cloudflare customers were able to pivot away from the platform temporarily so that visitors could still access their websites. But security experts say doing so may have also triggered an impromptu network penetration test for organizations that have come to rely on Cloudflare to block many types of abusive and malicious traffic.
Also: Insights From ISMG's Global Events, Tenzai's $75 Million Seed RoundIn this week's panel, ISMG editors broke down the mounting pressure on the Department of Health and Human Services and its privacy and security operations, the $75 million seed round for autonomous pen testing startup Tenzai and key themes from ISMG's recent global summits and executive roundtables.
Pen Tests Find States Thwart Basic Attacks But Are Vulnerable to Sophisticated OnesPen testing of 10 Medicaid management and enrollment systems found that while the nine states and one territory implemented "generally effective" security controls to prevent limited cyberattacks, improvements are needed to protect against more sophisticated attacks, said a watchdog agency report.
Penetration testing helps organizations ensure IT systems are secure, but it should never be treated in a one-size-fits-all approach. Traditional approaches can be rigid and cost your organization time and money – while producing inferior results. The benefits of pen testing are clear. By empowering “white hat” hackers to attempt to breach your system using similar tools and techniques to
AI-native Villager, which automates Kali and DeepSeek penetration tests, has reached 11,000 PyPI downloads fueling dual-use threat
A new artificial intelligence (AI)-powered penetration testing tool linked to a China-based company has attracted nearly 11,000 downloads on the Python Package Index (PyPI) repository, raising concerns that it could be repurposed by cybercriminals for malicious purposes
Imagine this: Your organization completed its annual penetration test in January, earning high marks for security compliance. In February, your development team deployed a routine software update. By April, attackers had already exploited a vulnerability introduced in that February update, gaining access to customer data weeks before being finally detected
The rate of evolution has been glacial, but tools now understand cloud environments and can target Web applications.
Imagine receiving a penetration test report that leaves you with more questions than answers. Questions like, "Were all functionalities of the web app tested?" or " Were there any security issues that could have been identified during testing?" often go unresolved, raising concerns about the thoroughness of the security testing. This frustration is common among many security teams. Pentest
IT leaders know the drill—regulators and cyber insurers demand regular network penetration testing to keep the bad guys out. But here’s the thing: hackers don’t wait around for compliance schedules
Riverwood Capital Leads Investment in Security Validation Firm to Grow in AmericasPicus Security has received $45 million in funding led by Riverwood Capital. The investment will accelerate product development in exposure management, including attack surface management and automated pen testing. The company plans to expand further in the Americas, targeting key growth areas.
External Attack Surface Management (EASM) coupled with Penetration Testing as a Service (PTaaS) can help find those blind spots and hidden assets exposed on your network. Learn more from Outpost24 about how combining EASM and PTaaS can help reveal these hidden pitfalls. [...]