TL;DR: Continuous validation helped a distributed equipment rental company replace point-in-time pentests to uncover exploitable exposure faster, validate an SSH key leak within eight hours, and turn suspected Cisco weakness and Active Directory password issues into measurable remediation, according to Horizons.ai. The practical lesson is that exposure management now depends on evidence, retesting, and identity control changes, not assessment cadence alone.
At a glance
What this is: This is an analysis of how one distributed equipment rental company used continuous testing to replace point-in-time pentests with evidence-based exposure management.
Why it matters: It matters because identity, credential, and configuration exposure can emerge between scheduled assessments, so IAM and security teams need validation loops that show whether remediation actually reduces risk.
By the numbers:
- The company found more findings in 12 hours than a third-party engagement found in roughly 30 days.
- Users with similar passwords dropped from 880 to 209 after remediation and retesting.
Context
Continuous exposure management is the practice of testing real attack paths repeatedly as an environment changes, rather than assuming a point-in-time assessment still reflects current risk. In distributed enterprises, that matters because identity, credentials, and misconfigurations can change faster than annual or quarterly testing cycles can keep up.
The identity angle is direct: SSH keys, weak passwords, and service-desk password handling all shape attack surface, lateral movement, and privilege abuse. When those controls are only checked periodically, security teams may be measuring history instead of current exposure.
The article uses one equipment rental company’s operational environment to show that this is not an abstract governance issue. Its starting position is typical for large enterprises with changing infrastructure, mixed user populations, and control drift between assessments.
Key questions
Q: What breaks when exposure management is only performed periodically?
A: The main failure is timing. Assets, configurations, and reachable services change faster than a periodic review can capture, so the organisation learns about exposure after it has already been live. That leaves teams reacting to stale data while attackers work against the current environment.
Q: Why do weak credentials create more risk when validation is infrequent?
A: Weak credentials become more dangerous when they are not continuously measured because teams cannot tell whether the exposure is isolated or systemic. In this article, password testing exposed a broad identity problem, not a one-off account issue. Continuous validation turns a hidden population risk into something that can be remediated and then retested.
Q: How can security teams tell whether a fix actually reduced exposure?
A: They should test whether the original attack outcome can still be reproduced after remediation. If the same-scope retest cannot achieve the same impact, the fix has evidence behind it. If it can, the programme has only documented activity, not reduction.
Q: When should organisations prioritise continuous validation over point-in-time pen testing?
A: Prioritise continuous validation when code releases, infrastructure changes, or identity changes happen frequently enough that a quarterly test cannot keep pace. It is most useful when credentials, permissions, or business logic shift often, because those are the conditions where AI-assisted attackers can discover and exploit gaps faster than manual review cycles can respond.
Technical breakdown
Why point-in-time pentests miss changing exposure
Point-in-time testing captures a snapshot, not a living attack surface. In environments where systems, identities, and access paths change daily, a vulnerability or weak credential can appear after the test and disappear before the next scheduled review. Continuous exposure management closes that gap by repeatedly validating whether a condition is still present and whether it is actually exploitable. The important shift is from theoretical weakness to evidence of reachable attack paths, which makes remediation decisions more defensible.
Practical implication: treat validation as a continuous control, not a scheduled event, when exposure can change between assessments.
How exposed credentials and SSH keys become attack paths
An exposed SSH key is not just a secret leakage problem. It becomes an entry point when it is paired with reachable infrastructure and insufficient segmentation or lifecycle control. In this case, a routine environment change created a web server in a root directory and exposed SSH key pairs, creating a path for lateral movement. That is the pattern continuous exposure management is meant to catch: a mundane operational change creates a new identity-bearing artifact that can be abused before the next assessment window.
Practical implication: tie secret and key exposure testing to infrastructure change detection, not only to periodic credential reviews.
Why evidence matters more than suspicion in exposure management
Suspicion can identify candidates for review, but evidence determines what deserves priority. The article shows this with suspected Cisco weakness and Active Directory password issues: validation turned both from concerns into measurable, actionable exposure. This is especially relevant for identity governance because password policy, banned-password enforcement, service desk handling, and privilege scope all affect whether identity weaknesses are isolated or systemic. When validation is continuous, teams can test the effect of remediation instead of assuming policy changes worked.
Practical implication: use retesting to confirm that identity and infrastructure changes reduced exposure before closing the loop.
Threat narrative
Attacker objective: The likely objective is to gain authenticated access through exposed credentials or keys and then move deeper into the environment.
- Entry begins when a change introduces a reachable web server in the root directory and exposes SSH RSA key pairs.
- Credential access occurs when weak or default SSH credentials and exposed keys create usable access paths for an attacker.
- Escalation and lateral movement become possible when those credentials connect to broader internal systems and infrastructure.
- Impact is the expansion of exploitable exposure across the environment until remediation and retesting close the path.
Breaches seen in the wild
- Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous exposure management is becoming a governance model, not just a testing model. The article shows that the meaningful unit of control is no longer the annual pentest result, but the evidence loop between change, validation, remediation, and retest. For IAM and PAM teams, that shifts attention to when exposure appears and how quickly it is verified. Practitioners should treat evidence production as part of the control itself.
Identity exposure is often operational, not purely technical. Password policy, service-desk reset practices, and SSH key handling all show up as attack surface when they are not continuously validated. That is why the article’s Active Directory findings matter: they are not just weak-password anecdotes, they are proof that identity controls can drift into systemic exposure. Practitioners should look for the control that lets drift survive between reviews.
Continuous validation creates a named gap: the assessment cadence gap. That gap is the time between when an exposure is introduced and when a scheduled control notices it. In hybrid and distributed environments, that delay is often where compromise opportunities live. The practitioner conclusion is simple: if the cadence is slower than the environment changes, the control is already behind.
CTEM only works when it is tied to measurable identity and infrastructure evidence. The article shows that the value is not the framework label but the operational discipline of proving exploitability, remediating, and measuring reduction. That aligns closely with access governance and NHI oversight because credentials, keys, and permissions are the things most likely to turn a configuration change into a security event. Practitioners should use evidence to decide which exposures are real, not merely present.
Security teams need to stop treating remediation as the end state. Retesting after password policy changes and infrastructure fixes is what turns a one-time finding into a governance signal. Without that second measurement, teams cannot know whether the control change actually reduced exposure or only changed the report. Practitioners should make retest evidence a required exit criterion for closure.
What this signals
Assessment cadence is now a control gap. When the environment changes daily, the delay between a configuration change and the next security review becomes an exposure window, not a scheduling detail. For practitioners, that means validation needs to move closer to change events, especially where credentials and identity-bearing artefacts can be created or exposed by routine work.
Identity controls need continuous evidence, not policy declarations. Password length, banned-password lists, and password reset workflows only matter if teams can prove that they reduced weak or compromised credentials over time. For IAM and PAM programmes, the practical test is whether retesting shows fewer exposures after the change.
Continuous exposure management should be read as an evidence problem as much as a tooling problem. Security teams that can prove exploitability, remediation, and reduction will make better prioritisation decisions than teams relying on static assessment windows. The next step for most programmes is to connect validation output to change management and identity governance workflows.
For practitioners
- Instrument continuous retesting for identity-bearing changes Link exposure validation to infrastructure and identity changes so new web servers, keys, passwords, and service accounts are checked as soon as they appear.
- Validate exploitable exposure before prioritising remediation Use evidence of reachability and abuse potential to decide whether a weakness is urgent, rather than relying on severity labels or assumptions.
- Retest password and access policy changes Confirm that banned-password lists, length increases, and service-desk reset changes actually reduce cracked or similar passwords across the environment.
- Treat secret exposure as a change-management signal Investigate newly exposed SSH keys, API keys, and other credentials as indicators that a recent operational change widened attack surface.
Key takeaways
- Point-in-time testing can miss exposure that emerges after the assessment, which is why continuous validation is becoming a governance issue as much as a security one.
- The article shows that identity and credential problems, including exposed SSH keys and weak passwords, are easier to fix when teams can prove what is actually exploitable.
- Retesting after remediation is the difference between claiming risk reduction and demonstrating it, especially in environments where change is constant.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Exposed SSH keys and weak credentials create credential access and lateral movement paths. |
| Recommendation — Map newly exposed keys and weak credentials to TA0006 and TA0008, then prioritize the paths with reachable access. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | SSH key exposure is a direct secret leakage problem that creates immediate attack surface. |
| NHI-07 — Long-Lived Secrets | The article shows how identity exposure persists until retesting proves the exposure has been removed. | |
| Recommendation — Scan for exposed SSH keys and other secrets on every meaningful change and revoke compromised material immediately. Shorten secret lifetime and require retest evidence before accepting a credential or key as no longer exposed. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Password policy, banned passwords, and credential handling are central to the Active Directory findings. |
| Recommendation — Apply IA-5 to enforce stronger authenticator lifecycle controls and verify that password changes reduce compromise risk. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article ties exposure to permissions, passwords, and identity scope across the environment. |
| Recommendation — Review permissions and authenticator scope together so exposure from identity drift is detected before it becomes exploitable. | ||
Key terms
- Continuous Threat Exposure Management: Continuous Threat Exposure Management is the ongoing process of finding which assets, identities, and paths are actually reachable from the current environment. It moves risk assessment away from static inventories and toward live exposure, so security teams can prioritise what an attacker or misuse path can reach now.
- Assessment Cadence Gap: The time between when a risky change is introduced and when a scheduled review or test can detect it. In fast-changing environments, this gap becomes an exposure window where secrets, credentials, or misconfigurations can be abused before the next assessment.
- Identity-bearing Artefact: Any object that can be used to authenticate, authorise, or move laterally, such as a password, SSH key, token, certificate, or service account credential. These artefacts matter because exposure is not just about access, but about what can be reused or abused.
- Evidence-Based Remediation: A remediation model where fixes are not considered complete until the organisation can prove they worked through retesting or other objective evidence. This turns closure into a verifiable control outcome rather than a ticket status.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps security and IAM practitioners turn exposure evidence into durable access governance.
Published by the NHIMG editorial team on September 14, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org