Notifications
Clear all
Topic starter
02/08/2026 11:39 am
TL;DR: Repeated snapshot testing missed exploitable issues, including a day-one cross-site scripting finding and remediation guidance tied to attacker paths, prompting JB Poindexter to move from quarterly pentests to continuous validation, according to Novee. Point-in-time assurance is no longer enough when validation must prove exploitability in the live environment.
NHIMG editorial — based on content published by Novee: a case study on how JB Poindexter’s CISO moved from quarterly pentests to continuous validation
Questions worth separating out
Q: How should security teams replace point-in-time pentests with continuous validation?
A: Start by attaching validation to the changes that actually alter risk, including releases, new API routes, cloud configuration updates, and identity bindings.
Q: Why do point-in-time pentests miss real-world attack paths?
A: Because exploitability changes faster than most testing cycles.
Q: What breaks when exploitability is not tested before remediation is closed?
A: Teams may close tickets that reduce paperwork but not attacker capability.
Practitioner guidance
- Implement continuous validation for exposed assets Scope validation to internet-facing applications, APIs, and user workflows that can lead to account compromise or website takeover.
- Prioritise issues by attacker outcome Sort remediation queues by whether a flaw can be chained into account compromise, session hijack, data exposure, or service abuse.
- Build retest checkpoints into closure workflows Require a successful retest before a vulnerability ticket is closed.
What's in the full article
Novee's full article covers the operational detail this post intentionally leaves for the source:
- The POC workflow and onboarding sequence that got continuous validation running in 30 minutes.
- The day-one cross-site scripting finding and how the exploit path was demonstrated.
- The phased rollout approach across business units and network segments.
- The remediation collaboration model that linked findings to retesting and closure.
👉 Read Novee's case study on continuous validation replacing quarterly pentests →
Continuous validation vs quarterly pentests: what changes for security teams?
Explore further
02/08/2026 12:51 pm
Continuous validation is now a governance problem, not just a testing method. Quarterly pentests often satisfy process expectations while missing the live conditions that determine whether an issue is actually exploitable. That creates a control assurance gap between reported security and operational security. Security leaders should treat validation cadence as part of risk governance, not a technical afterthought.
A question worth separating out:
Q: Who is accountable when a vulnerability report misses an exploitable issue?
A: Accountability sits with the programme owner who accepted the testing model and closure criteria, not only with the tester. If the organisation chose snapshots over continuous validation, the control gap is governance-led. Security leaders, application owners, and risk owners all need clear closure standards and evidence requirements.
👉 Read our full editorial: Continuous validation exposes exploitable gaps that point-in-time pentests miss
