Topic starter
14/09/2026 10:10 am
TL;DR: Exploiting vulnerabilities remained the most common intrusion path for six years running, accounting for 32% of intrusions in 2025, but external penetration testing only proves what is visible in scope at the moment it runs, according to Escape and Mandiant's M-Trends 2026. The practical gap is not test depth alone, but continuous discovery, because internet-facing assets, acquired servers, and AI endpoints can appear after scope is frozen and before the report is read.
Editorial analysis by NHI Mgmt Group, based on content published by Escape: “What an external penetration test is and how one is actually run”.
By the numbers:
- Exploiting a vulnerability was the most common way attackers broke in for six years running, accounting for 32% of intrusions in 2025.
Key questions
Q: What breaks when external penetration test scope is based on a stale asset list?
A: The test stops measuring the real perimeter and starts measuring only the subset the organisation remembered to include.
Q: Should organisations prioritise continuous testing over annual penetration tests?
A: Yes, in high-change environments.
Q: What do teams get wrong about external-only pentesting?
A: They often mistake surface coverage for assurance.
Practitioner guidance
- Implement continuous external asset discovery Continuously rebuild the internet-facing inventory from cloud, DNS, IP, and web exposure sources so new hosts never wait for the next annual test.
- Separate test scope from scan scope Use the penetration test to prove exploitability, but keep scanning and discovery running independently so the known-asset list does not define the whole perimeter.
- Include authentication boundaries in scope Document SSO, VPN, OAuth, MFA, and token-based access points as test targets because many external exposures only become real after login.
Bottom line: The article's core point is that external penetration testing cannot secure an estate whose live assets are discovered only after the scope has already been frozen.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
Continuous discovery is now a perimeter governance requirement, not an operational convenience. External testing only answers the question of what was visible at a point in time, which means every post-scope asset is effectively out of policy until rediscovered. That is a control failure in environments where cloud accounts, acquisition sprawl, and internet-facing AI services can appear between test cycles. Practitioners should treat live discovery as part of the control plane, not as a reporting aid.
A question worth separating out:
Q: How should identity teams account for authentication when external services are in scope?
A: They should test the login boundary itself, not just the reachable host, because SSO, MFA, OAuth, and token handling often determine whether an exposed service is actually usable. For IAM and NHI programmes, that means public-facing access paths must be owned, monitored, and retested like any other privileged entry point.
👉 Read our full editorial: External penetration tests miss what your asset list never sees