Notifications
Clear all
Topic starter
14/08/2026 6:33 pm
TL;DR: Continuously changing exposure, rather than periodic snapshots, is what increasingly should define pentest cadence, as vulnerability counts, including externally exploitable ones, can rise between assessments, according to Hadrian. The operational question for practitioners is whether discovery, prioritisation, and remediation can keep pace with asset churn and attack surface drift, not just whether testing was completed.
NHIMG editorial — based on content published by Hadrian: Automated penetration testing vs manual pentesting
Questions worth separating out
Q: How should security teams use continuous exposure data in practice?
A: They should use it to re-rank remediation work as the environment changes, not just to report more findings.
Q: Why does exposure tracking matter for IAM and NHI programmes?
A: Because exposed systems often reveal or amplify identity risk.
Q: What fails when pentesting stays purely periodic?
A: The organisation loses visibility into drift between assessments.
Practitioner guidance
- Build a continuous exposure baseline Track newly surfaced vulnerabilities against the last assessment date so you can see how quickly risk accumulates between tests.
- Link exposure findings to identity paths Map each externally reachable weakness to the service accounts, API keys, certificates, and admin paths it could expose.
- Separate discovery from validation Use automated testing to widen coverage, then confirm exploitability and business impact with human review before escalating remediation.
What's in the full article
Hadrian's full blog covers the operational detail this post intentionally leaves for the source:
- How the Exposure Clock is configured and reset around assessment cycles
- What the agentic pentesting workflow changes in day-to-day testing operations
- Which asset and configuration changes are monitored between assessments
- How the platform surfaces high-impact risks for remediation teams
👉 Read Hadrian's blog on the Exposure Clock and agentic pentesting →
Exposure clocks and agentic pentesting: are your controls keeping up?
Explore further
14/08/2026 6:41 pm
Continuous exposure, not assessment cadence, is now the real control problem. Periodic pentests tell teams what was true at a moment in time, but they do not show how quickly the environment changes afterwards. In modern estates, the risk lies in the interval between reviews, when new weaknesses can appear and remain unchallenged. For practitioners, the decisive question is whether exposure visibility is continuous enough to drive action.
A question worth separating out:
Q: When should teams prioritise automated pentesting over manual testing?
A: Teams should prioritise automation when they need continuous coverage across frequent code changes, large endpoint counts, or repetitive regression checks. Manual testing should remain the priority when the risk depends on human reasoning, feature interaction, or policy interpretation. The best programme uses automation for breadth and manual review for exploitability and intent.
👉 Read our full editorial: Exposure clocks and agentic pentesting: what teams need to know
