Topic starter
02/08/2026 11:34 am
TL;DR: Pentesting built for annual cycles and fixed scopes misses the attack paths that matter most in dynamic environments, Horizons.ai reports. Testing should show whether access paths still hold, with exploitability, chaining, and fix validation as the stronger risk signals.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “The 2026 Buyer’s Guide to Penetration Testing”.
Key questions
Q: Why does exploitability matter more than finding count in modern pentesting?
A: Because exploitability tells you whether a weakness can be chained into real access or impact, while finding count only measures output.
Q: How do organisations know whether continuous pentesting is actually reducing risk?
A: Look for fewer stale findings, faster remediation of validated issues, and better alignment between test coverage and current release activity.
Q: What breaks when pentesting is still evaluated as a compliance exercise?
A: It misses the control paths that matter most.
Practitioner guidance
- Define exploitability-based success criteria Replace finding-count scoring with criteria that ask whether a path can be exercised against live or production-like assets, and whether it demonstrates meaningful access, privilege gain, or data reach.
- Require attack-path chaining in every evaluation Ask vendors to show how they link credential exposure, privilege relationships, and reachable assets into a complete route that reflects actual adversary movement.
- Make fix validation mandatory Do not close a remediation until retesting shows the original path no longer works and the control change survives a repeat attempt under the same assumptions.
Bottom line: Pentesting programs built around annual cycles and fixed scopes can miss the attack paths that matter most in dynamic, identity-driven environments.
Glossary terms: Exploitability context, Attack-path chaining, Fix validation, Coverage Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:48 pm
Pentesting is moving from assurance theatre to adversary simulation. The market is reacting to a simple reality: calendar-based testing and finding volume do not map cleanly to identity-driven compromise. When service accounts, tokens, and cloud roles are the real bridge to impact, a test has to show whether those paths can be abused in sequence. Buyers should treat exploitability as the first-order metric, not a supplementary one.
A question worth separating out:
Q: When should teams prioritise validated fixes over more test coverage?
A: When the backlog is already large enough that discovery outpaces remediation. At that point, the useful control is not more findings but faster closure of confirmed weaknesses, especially in systems that change frequently. More coverage helps only if the organisation can turn results into durable fixes and retest them.
👉 Read our full editorial: Pentesting evaluation is shifting toward exploitability and risk reduction