TL;DR: Exploiting vulnerabilities remained the most common intrusion path for six years running, accounting for 32% of intrusions in 2025, but external penetration testing only proves what is visible in scope at the moment it runs, according to Escape and Mandiant's M-Trends 2026. The practical gap is not test depth alone, but continuous discovery, because internet-facing assets, acquired servers, and AI endpoints can appear after scope is frozen and before the report is read.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Escape's blog post: External penetration testing measures what is reachable from the public internet at a point in time, but the real risk is scope drift as live assets appear after the asset list is set.
Why it matters: For IAM, NHI, and broader security teams, this matters because the assets that go unseen often include exposed identities, APIs, and internet-facing services whose access paths need continuous governance, not periodic validation.
By the numbers:
- Exploiting a vulnerability was the most common way attackers broke in for six years running, accounting for 32% of intrusions in 2025.
Context
External penetration testing is a point-in-time assessment of what an attacker can reach from the public internet, but the control only reflects the asset list at the moment the test begins. That creates a governance gap when internet-facing hosts, APIs, cloud services, acquired infrastructure, or AI endpoints appear after scope is frozen and before remediation starts.
For identity and access teams, the important issue is not only exposed hosts but exposed access paths. Public services often depend on credentials, tokens, and login workflows, so stale scope can hide the real attack surface behind the perimeter, especially where non-human identities or delegated access are involved.
Key questions
Q: What breaks when external penetration test scope is based on a stale asset list?
A: The test stops measuring the real perimeter and starts measuring only the subset the organisation remembered to include. That creates false confidence, because newly added subdomains, acquired servers, staging systems, and exposed AI endpoints remain untested. The right control is continuous discovery tied to scope governance, not a one-time inventory review.
Q: Should organisations prioritise continuous testing over annual penetration tests?
A: Yes, in high-change environments. Continuous testing is more aligned to how autonomous attackers operate and gives teams faster feedback on exposure, especially where APIs, web apps, and shadow AI change often. Annual tests still have value, but they are too slow and too narrow to serve as the primary assurance model.
Q: What do teams get wrong about external-only pentesting?
A: They often mistake surface coverage for assurance. External testing can confirm what is visible from the outside, but it cannot reliably validate intent, hidden control paths, or whether a change introduced new exposure in a sensitive workflow. That is why it should complement, not replace, white box analysis.
Q: How should identity teams account for authentication when external services are in scope?
A: They should test the login boundary itself, not just the reachable host, because SSO, MFA, OAuth, and token handling often determine whether an exposed service is actually usable. For IAM and NHI programmes, that means public-facing access paths must be owned, monitored, and retested like any other privileged entry point.
Technical breakdown
Why the first recon pass defines the ceiling of an external test
External penetration testing starts with reconnaissance because the tester can only validate what they discover. If the scope omits a host, subdomain, API endpoint, or cloud asset, that target is invisible to later exploitation stages even if it is fully exposed. This is why the initial asset list acts as a ceiling: it determines the highest possible coverage the engagement can reach. In practice, that makes scoping and discovery part of the control design, not just administration.
Practical implication: Treat external discovery as a prerequisite control, not a scheduling step, so hidden assets never sit outside the testing boundary.
How login flows and exposed services change external attack paths
External testing is not only about open ports. Once a tester reaches a login page, VPN gateway, SSO appliance, API endpoint, or cloud service front end, the engagement shifts from surface enumeration to access validation. The article highlights OAuth, MFA, CAPTCHA, browser-based flows, and token handling because real-world exposure increasingly sits behind authentication. That matters for identity governance because authentication strength, token handling, and session control determine whether exposure becomes usable access. For NHIs, the same logic applies to machine-authenticated APIs and service endpoints.
Practical implication: Map authentication boundaries into the scope so external testing evaluates whether exposed services are actually exploitable, not merely reachable.
Why asset drift breaks the value of a one-time report
A penetration test becomes stale as soon as the external estate changes, because the report can only describe what existed during the test window. New staging systems, acquired environments, and internet-facing AI services can appear after validation is complete, leaving the written report technically accurate and operationally obsolete. That is the governance failure the article exposes: the asset inventory and the live perimeter are not being controlled as one system. For identity-led programmes, that creates blind spots around who or what can authenticate to newly exposed services.
Practical implication: Link testing to continuous discovery and retest triggers so newly exposed assets inherit the same control scrutiny as documented ones.
Threat narrative
Attacker objective: Reach externally exposed services and turn undocumented assets into a viable access path before defenders realise they exist.
- Entry begins with an exposed internet-facing asset that was absent from the original scope, such as a staging host, acquired server, or AI endpoint.
- Credential or access validation then determines whether the service can be reached through a login flow, token exchange, or weak authentication boundary.
- Escalation occurs when the tester, and by implication an attacker, turns a reachable service into working access because the asset was never assessed.
- Impact is the creation of a false sense of security, where the report says the perimeter is covered even though live assets remain untested.
Breaches seen in the wild
- Gainsight Salesforce breach 2025: Stolen OAuth tokens for Gainsight's Salesforce app, some eight years old, were used against customer orgs; Google saw 200+ instances at risk.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous discovery is now a perimeter governance requirement, not an operational convenience. External testing only answers the question of what was visible at a point in time, which means every post-scope asset is effectively out of policy until rediscovered. That is a control failure in environments where cloud accounts, acquisition sprawl, and internet-facing AI services can appear between test cycles. Practitioners should treat live discovery as part of the control plane, not as a reporting aid.
External scope drift creates a verification gap that traditional pentest cadences cannot close. The article shows why one-off assurance models lag behind modern infrastructure change: the perimeter is rebuilt daily by business activity, not quarterly by audit plans. This is especially relevant where public services depend on federated identity, service tokens, or delegated machine access. The practitioner conclusion is to align test scope with the live asset inventory, not the annual calendar.
Identity and non-human access expand the meaning of the external attack surface. When a publicly reachable service uses SSO, OAuth, API keys, or other machine credentials, the real risk is not just exposure but who or what can authenticate once exposure exists. That makes external pentesting relevant to IAM and NHI governance because access control failures often sit behind the visible host, not on the host itself. Teams should govern exposed identities with the same rigor as exposed infrastructure.
External penetration testing is losing value as a standalone assurance mechanism. It still matters, but only when paired with continuous discovery, ownership, and retest discipline. Without those controls, the engagement becomes a snapshot that cannot keep pace with the organisation's changing external footprint. The practical conclusion is that annual testing should be the verification layer on top of always-on asset visibility, not the only line of defense.
What this signals
Live scope is now the real control objective: if the asset inventory drifts faster than the test cadence, external assurance degrades into historical documentation. Programmes that rely on annual validation need to pair it with continuous discovery and ownership routing so newly exposed hosts are not invisible between reviews.
For IAM and NHI teams, the important lesson is that externally reachable services often become security issues only after authentication is added to the equation. OAuth flows, service tokens, and machine logins can turn a visible host into a viable access path, so identity controls must be part of perimeter governance from the start.
For practitioners
- Implement continuous external asset discovery Continuously rebuild the internet-facing inventory from cloud, DNS, IP, and web exposure sources so new hosts never wait for the next annual test.
- Separate test scope from scan scope Use the penetration test to prove exploitability, but keep scanning and discovery running independently so the known-asset list does not define the whole perimeter.
- Include authentication boundaries in scope Document SSO, VPN, OAuth, MFA, and token-based access points as test targets because many external exposures only become real after login.
- Retest after every material change Trigger retesting when acquisitions, staging launches, or major DNS changes add new externally reachable assets, rather than waiting for the next scheduled review.
Key takeaways
- The article's core point is that external penetration testing cannot secure an estate whose live assets are discovered only after the scope has already been frozen.
- Its evidence is a familiar intrusion pattern: vulnerability exploitation remains the dominant initial access path, but visibility gaps let new services evade testing.
- The practical answer is continuous external discovery plus retesting on change, so the tested perimeter stays aligned with the real one.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0043 — Reconnaissance | The article centres on how perimeter recon limits everything a tester can find. |
| Recommendation — Map external discovery gaps to TA0043 and hunt for assets your inventory never sees. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Live external assets are the inventory problem this article keeps exposing. |
| Recommendation — Maintain a continuously updated inventory of internet-facing assets and tie test scope to it. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | The article's core failure mode is incomplete enterprise asset visibility. |
| Recommendation — Use CIS-1 to keep the exposed asset inventory current before penetration testing begins. | ||
| NIST SP 800-53 Rev 5 | CA-8 — Penetration Testing | This article is directly about the limits of penetration testing as assurance. |
| Recommendation — Use CA-8 to validate external attack paths, but pair it with continuous discovery. | ||
| OWASP API Security Top 10 | API9 — Improper Inventory Management | External APIs are part of the exposed surface and become invisible when inventory is stale. |
| Recommendation — Apply API9 to ensure externally exposed APIs are discovered and tracked before testing. | ||
Key terms
- External Penetration Test: An external penetration test is a controlled security assessment performed from outside the organisation to simulate how an attacker would reach internet-facing systems. It focuses on public assets such as web applications, APIs, cloud services, login portals, and exposed servers, then evaluates misconfigurations, injection flaws, and weak perimeter controls.
- Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
- Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
- Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control design to the broader access paths that external testing often reveals.
Published by the NHIMG editorial team on September 14, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org