Notifications
Clear all
Topic starter
18/08/2026 2:14 pm
TL;DR: Detection and response are inherently reactive, and continuous offensive testing is needed to produce evidence on whether exposures should be fixed, mitigated, or formally accepted, according to Sprocket Security. The core implication is that security leaders need offensive validation to understand blast radius, control gaps, and residual risk faster than annual review cycles allow.
NHIMG editorial — based on content published by Sprocket Security: continuous offensive security testing and the question of whether leaders can beat the adversary
Questions worth separating out
Q: What breaks when offensive testing is still done on a periodic schedule?
A: Periodic testing misses the gap between assessments, which is where AI-enabled attackers operate.
Q: Why do offensive findings matter for IAM and NHI programmes?
A: Because identity scope often determines whether an exposed weakness becomes a real breach path.
Q: How do security teams know if a mitigation is actually working?
A: They retest the exact attack path that proved the exposure in the first place.
Practitioner guidance
- Operationalise fix, mitigate, accept decisions Create a formal workflow that requires every validated exposure to be assigned to fix, mitigate, or accept, with a named owner, due date, and review trigger.
- Map validated attack paths to ATT&CK Require each offensive finding to include a MITRE ATT&CK technique mapping so remediation teams can align the exposure with specific adversary behaviour and detection engineering can build on the same evidence.
- Tie identity restrictions to exploitable paths When a finding involves access scope, standing privilege, or third-party connectivity, route it to IAM or PAM owners and ask what identity restriction would actually break the attack path before the next review cycle.
What's in the full article
Sprocket Security's full article covers the operational detail this post intentionally leaves for the source:
- The six procurement questions the author recommends asking before buying a continuous offensive security testing capability.
- The cost, human-validation, and one-operator coverage metrics used to judge whether a programme is actually operational.
- The article's exact framing for how to stop testing safely and what a vendor should leave behind when it halts.
- The practical distinctions between fix, mitigate, and accept as they apply to board-level risk decisions.
👉 Read Sprocket Security's analysis of continuous offensive security testing and risk decisions →
Continuous offensive testing: what it means for SOC and IAM teams?
Explore further
18/08/2026 3:06 pm
Continuous offensive testing is becoming a governance layer, not just a red-team service. The value is not simply that a weakness is found. The value is that leadership gets evidence on whether to fix, mitigate, or accept with traceable ownership. That is a better model than relying on annual pentests or SOC confidence alone, because it makes residual risk explicit and reviewable.
A question worth separating out:
Q: Who should own risk acceptance after a validated exposure is found?
A: Acceptance should sit with a named executive or asset owner, not with the testing team. It needs a date, a rationale, and a trigger that reopens review, such as a patch, regulatory change, or peer breach. That is what makes acceptance accountable rather than a disguised form of inaction.
👉 Read our full editorial: Continuous offensive testing changes how leaders answer risk
