Topic starter
18/08/2026 2:49 pm
TL;DR: Rigid two-week pentest scopes and checklist-driven coverage can cut off discovery before investigators understand how an exploit path really forms, while intuition-driven offensive security prioritises footholds, pivot points, and business impact, according to Sprocket Security. The shift matters because it rewards adversary thinking, deeper documentation, and human judgment over finding counts and ticket volume.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Ahead of the Breach – Andy Grant on Offensive Intuition and Letting Hackers Hunt”.
Key questions
Q: How should security teams run offensive testing when the goal is real impact rather than coverage?
A: Treat the engagement as an investigation into attacker pathways, not a race to fill a checklist.
Q: When does fixed pentest scope become a liability?
A: Fixed scope becomes a liability when evidence suggests a connected attack path but the test ends before investigators can follow it.
Q: What do security teams get wrong about offensive testing metrics?
A: They often treat the number of tests or findings as proof of maturity.
Practitioner guidance
- Redesign offensive work around hypotheses, not checklists Give testers permission to pursue the most plausible attack path even when it falls outside the original script, then require a written rationale for why that path matters.
- Measure offensive security by business impact Replace pure finding-count reporting with evidence of whether the work exposed a realistic compromise path, changed executive decisions, or improved engineering understanding.
- Build guardrails for exploratory testing Use peer review, structured check-ins, and documented decision points so flexible scope increases discovery without becoming undisciplined or unrepeatable.
Bottom line: Rigid pentest scopes can obscure the attack path that matters most when researchers need time to connect footholds to impact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:31 pm
Impact is a better offensive-security metric than issue volume. A programme that rewards finding counts will inevitably favour shallow discovery over meaningful attacker simulation. In practice, this weakens visibility into the paths that matter most, especially when access, privilege, and trust relationships are the real entry points. The stronger model measures whether the work changed what the organisation understands about exposure and response.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations decide where AI belongs in offensive security workflows?
A: Use AI where speed, correlation, and repetitive analysis create measurable value, such as asset monitoring, context gathering, and first-pass prioritisation. Keep humans in charge of judgement, scope, and final risk decisions. If a workflow cannot explain why a finding matters, it is not ready to drive remediation on its own.
👉 Read our full editorial: Intuition-driven offensive security shifts from coverage to impact