Topic starter
02/08/2026 12:01 pm
TL;DR: Weekly validation can expose exploitable cloud and hybrid exposure long before an annual pentest would, according to Horizons.ai’s account of a regulated financial and insurance organisation. The core lesson is that security assurance must follow environment change, not the calendar, or remediation will always trail risk.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “From Patch Tuesday to Pentest Wednesday®: Continuous Validation in a Regulated Environment”.
Key questions
Q: What breaks when organisations rely on annual pentesting alone?
A: Annual testing leaves long periods where new deployments, identity changes, and exposed endpoints go unvalidated.
Q: Why do standing AWS permissions increase the impact of stolen credentials?
A: Standing permissions let an attacker do useful work as soon as credentials are accepted.
Q: What are the signs that cloud exposure drift is undermining assurance?
A: Common signs include findings that recur after remediation, access paths that differ from the documented ownership model, and security issues discovered long after environment changes occurred.
Practitioner guidance
- Map validation cadence to environmental change Replace annual-only testing with a cadence that reflects cloud, hybrid, and outsourced change so exposure drift is visible before it becomes entrenched.
- Validate effective IAM reachability Test what a given AWS role, service account, or delegated credential can actually reach, including escalation paths and data access, rather than relying on role names alone.
- Require proof-based remediation closure Do not close findings until a retest confirms the attack path is gone and the original access path no longer works in the live environment.
Bottom line: Annual testing can confirm that controls existed at a point in time, but it cannot reliably show how exposure changed after the assessment window.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:07 pm
Continuous validation is now a governance requirement, not just a testing preference. Annual assurance models assume the control environment remains stable long enough for a snapshot to be meaningful. In cloud and hybrid estates that assumption breaks quickly, especially where acquisitions, outsourcing, and role drift alter the live attack surface. Practitioners should treat validation cadence as part of control design, not a reporting afterthought.
A question worth separating out:
Q: How can organisations decide whether continuous validation is worth it?
A: Measure whether it shortens the time between exposure change and remediation, reduces false positives, and identifies attack paths that static scans miss. If those three outcomes do not improve, the programme is producing activity rather than assurance.
👉 Read our full editorial: Continuous validation exposes the gap between compliance and reality