Topic starter
02/08/2026 11:34 am
TL;DR: Pentesting programs built for compliance cycles and fixed scopes no longer match identity-driven, fast-moving attack paths, according to Horizons.ai, so 2026 buying criteria are shifting toward exploitability, production-scale coverage, adaptive attack-path chaining, fix validation, and responsiveness to actively exploited vulnerabilities. The practical test is whether a program measures real risk reduction, not just how many findings it produces.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “The 2026 Buyer’s Guide to Penetration Testing”.
Key questions
Q: What breaks when pentesting is still evaluated as a compliance exercise?
A: It misses the control paths that matter most.
Q: Why does exploitability matter more than finding count in modern pentesting?
A: Because exploitability tells you whether a weakness can be chained into real access or impact, while finding count only measures output.
Q: How do organisations know whether continuous pentesting is actually reducing risk?
A: Look for fewer stale findings, faster remediation of validated issues, and better alignment between test coverage and current release activity.
Practitioner guidance
- Define exploitability-based success criteria Replace finding-count scoring with criteria that ask whether a path can be exercised against live or production-like assets, and whether it demonstrates meaningful access, privilege gain, or data reach.
- Require attack-path chaining in every evaluation Ask vendors to show how they link credential exposure, privilege relationships, and reachable assets into a complete route that reflects actual adversary movement.
- Make fix validation mandatory Do not close a remediation until retesting shows the original path no longer works and the control change survives a repeat attempt under the same assumptions.
Bottom line: Pentesting programs built around annual cycles and fixed scopes can miss the attack paths that matter most in dynamic, identity-driven environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:48 pm
Pentesting is moving from assurance theatre to adversary simulation. The market is reacting to a simple reality: calendar-based testing and finding volume do not map cleanly to identity-driven compromise. When service accounts, tokens, and cloud roles are the real bridge to impact, a test has to show whether those paths can be abused in sequence. Buyers should treat exploitability as the first-order metric, not a supplementary one.
A question worth separating out:
Q: When should teams prioritise validated fixes over more test coverage?
A: When the backlog is already large enough that discovery outpaces remediation. At that point, the useful control is not more findings but faster closure of confirmed weaknesses, especially in systems that change frequently. More coverage helps only if the organisation can turn results into durable fixes and retest them.
👉 Read our full editorial: Pentesting evaluation is shifting toward exploitability and risk reduction