Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: Exploiting vulnerabilities remained the most common intrusion path for six years running, accounting for 32% of intrusions in 2025, but external penetration testing only proves what is visible in scope at the moment it runs, according to Escape and Mandiant's M-Trends 2026. The practical gap is not test depth alone, but continuous discovery, because internet-facing assets, acquired servers, and AI endpoints can appear after scope is frozen and before the report is read.
NHIMG editorial — based on content published by Escape: external penetration testing, scope drift, and live perimeter reconstruction
By the numbers:
- Exploiting a vulnerability has been the most common way attackers break in for six years running, accounting for 32% of intrusions in 2025.
Questions worth separating out
Q: What breaks when external penetration test scope is based on a stale asset list?
A: The test stops measuring the real perimeter and starts measuring only the subset the organisation remembered to include.
Q: Why do external login portals and leaked credentials matter so much in penetration tests?
A: Because public authentication points turn exposure into access faster than most perimeter controls can respond.
Q: How can security teams tell whether an external penetration test was actually complete?
A: A complete test should show how the live perimeter was reconstructed, which asset classes were included, and what changed between scoping and execution.
Practitioner guidance
- Run continuous external asset discovery Rebuild your public footprint from cloud accounts, DNS records, and declared IP ranges on an ongoing schedule so the scope matches the live estate before testing begins.
- Separate scan coverage from penetration-test coverage Use scans for known asset lists and penetration tests for chained proof of access, because a scan cannot replace live validation of exposed paths.
- Include identity and login surfaces in external scope Map SSO portals, VPNs, webmail, and other authentication entry points alongside public applications, then test how leaked credentials and weak MFA change reachability.
What's in the full article
Escape's full article covers the operational detail this post intentionally leaves for the source:
- The phase-by-phase external testing workflow, including how the tester reconstructs the perimeter from cloud accounts, DNS, and IP ranges.
- The detailed scoping distinctions between black box, grey box, and white box testing, plus when each changes coverage.
- The specific validation methods for exposed ports, DNS misconfigurations, and internet-facing AI endpoints that the post only summarises.
- The reporting and retesting workflow that maps findings to owners and re-runs proofs after remediation.
👉 Read Escape's guide to external penetration testing scope, recon, and exploitation →
External penetration tests: are your controls keeping up with live scope?
Explore further
14/09/2026 10:11 am
Scope drift is the real failure mode in external testing. The article makes clear that the core issue is not whether a tester can find flaws, but whether the organization knows what is actually in scope when the test begins. In a cloud-heavy estate, the attack surface changes faster than annual assessment cycles. Practitioners should treat scope drift as a governance problem, not a tooling problem.
A question worth separating out:
Q: When should organisations move from external discovery to deeper penetration testing?
A: Organisations should move to deeper penetration testing when they need authenticated application testing, business logic review, exploit chaining analysis, or compliance-level validation. External discovery is good for finding exposed assets and obvious weaknesses, but it does not prove deeper resilience. The right handoff is when teams need assurance beyond what an unauthenticated external view can show.
👉 Read our full editorial: External penetration tests miss what your asset list never sees
