Because they do not rely on a single exploit. They adapt, persist, and chain actions across systems, so a control that passed one test may still fail once the attacker has time to blend in, move laterally, or revisit the environment. Continuous testing is needed to measure control durability under realistic pressure.
Why annual testing misses campaign-style threat actors
Annual testing often proves that a control worked against a known scenario on a known day. Campaign-style threat actors are different: they adapt between attempts, wait out defenders, and use multiple paths to reach the same objective. That means a control can look sound in a point-in-time exercise while still being brittle under sustained pressure.
What makes these actors effective is not just the exploit itself, but the way they sequence actions over time. A first attempt may fail, a second may use different infrastructure, and a later attempt may combine stolen credentials, lateral movement, and persistence to bypass the assumptions baked into a single test window.
The practical distinction is between control existence and control durability. Annual testing can confirm that a safeguard is present, but it rarely shows how that safeguard behaves when the attacker revisits the environment, changes tactics, or forces defenders to respond under uncertainty. For campaign-driven activity, durability matters more than initial success.
Where the blind spots usually appear
The most common blind spot is that point-in-time validation assumes the environment stays stable. In reality, adversaries probe for drift: a new identity path, a reused secret, a permissive exception, or a trust relationship that was not part of the original test. That is why a defence can be valid on paper and still fail in production conditions.
Another blind spot is that annual exercises often overrepresent direct exploitation and underrepresent the follow-on behaviour that makes campaigns successful. CISA cyber threat advisories and ENISA Threat Landscape reporting both reinforce that modern intrusions are frequently multi-stage, with persistence, credential abuse, and post-compromise movement extending far beyond the first point of entry.
This is also why control teams need to test for the conditions attackers create, not only the control state they expect. If the same access, identity, or trust path can be revisited repeatedly, the weakness is not necessarily the exploit itself, but the absence of continuous detection, revocation, or containment when the environment changes.
Why continuous pressure testing is the better measure
Continuous testing gives a more realistic answer because it measures how well controls hold up over time, under variation, and after the defender has already reacted once. It is less about reproducing a single breach and more about seeing whether the organisation can sustain resistance as the campaign evolves.
That is especially important for attack chains that depend on repeated use of access. A detection rule, segmentation control, or privilege boundary may appear effective in a controlled test, but the real question is whether it still works after an attacker has blended into normal activity, shifted infrastructure, or switched to a different access path. MITRE ATT&CK Enterprise Matrix is useful here because it helps teams map defence coverage to the full sequence of adversary behaviour, not just the initial technique.
For organisations that want a more operational view of campaign resilience, threat modeling and breach analysis are helpful complements. The State of NHI & AI Agent Breach Report 2026 shows how real-world attackers chain stolen access, secrets, and movement across environments, which is exactly the kind of pressure annual testing tends to under-sample.
Risk and Threat Considerations
Campaign-style activity increases exposure because the attacker is not betting on one failure. If a control resists the first attempt, the campaign can still succeed later by reusing access, exploiting drift, or waiting for a weaker moment in operations. That makes the real risk not just compromise, but delayed compromise after defenders assume the issue is closed.
Failure mechanism: Annual testing snapshots a control at a single moment, while the attacker tests the same control repeatedly across time, context, and follow-on actions. Once the environment changes, the original pass result may no longer reflect actual resistance.
Impact: Organisations can overestimate containment, miss lateral movement or persistence, and discover too late that a control only worked against the first stage of the campaign.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Tactics and Techniques Matrix — Enterprise Matrix | Maps the multi-stage attack chains that campaign actors use over time. |
| Recommendation — Map repeated adversary steps to ATT&CK and test coverage across the full chain. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Continuous monitoring is needed when threats adapt between annual tests. |
| Recommendation — Increase monitoring cadence so repeated attacker activity is detected between point-in-time tests. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Campaigns are often visible only through sustained logging and review over time. |
| Recommendation — Centralize and review logs continuously to surface repeated access and lateral movement. | ||
| NIST SP 800-53 Rev 5 | CA-7 — Continuous Monitoring | Directly supports ongoing control assessment under changing threat conditions. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Repeated attacker behavior is exposed by review of correlated audit evidence. | |
| Recommendation — Implement continuous monitoring to validate controls beyond annual assessment windows. Analyze audit records for recurring access patterns, pivots, and post-compromise activity. | ||
Practitioner Guidance
What to prioritise: Treat durability as the primary measurement, not test-day success. The useful question is whether the control still holds after identity changes, alert fatigue, tactical pivots, and partial defender response.
What to verify: Verify that repeated access attempts, reuse of stolen material, and movement between systems are actually detected or blocked. A control that needs a clean environment to look effective is not robust against campaign behaviour.
Common mistake: Teams often overvalue annual penetration tests because they produce a clear report. For campaign-style threats, the stronger signal is whether controls degrade gracefully, alert early, and force the attacker to pay escalating cost over time.
Practitioner takeaway: Test for persistence and adaptation, not just initial compromise, because campaign actors win when they can return after the first control has already been declared effective.