Notifications
Clear all
Topic starter
21/08/2026 4:49 pm
TL;DR: Transport and logistics companies are being pushed toward continuous security testing because episodic pentests leave long exposure gaps, according to INTIGRITI's analysis. The operational lesson is broader than the sector itself: when logistics systems, IoT, and supply chains are tightly coupled, security testing has to match the pace of change, not the audit calendar.
NHIMG editorial — based on content published by INTIGRITI: How transport and logistics businesses can strengthen their cyber defenses
By the numbers:
- In 2022, Expeditors International had to shut down most of its systems worldwide following a cyberattack.
- The incident cost Expeditors $47 million in extra charges for prolonged use of shipping containers at depots and terminals.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What fails when transport and logistics teams rely only on periodic pentesting?
A: Periodic pentesting creates blind spots between assessment cycles.
Q: Why do logistics environments need continuous security testing?
A: They need it because operational systems change continuously.
Q: How do security teams know if testing is keeping up with production change?
A: They should measure the time between a meaningful change and the next control decision that reflects it.
Practitioner guidance
- Build a continuous validation layer Augment scheduled pentests with ongoing testing tied to system changes, new integrations, and exposed internet-facing services.
- Map operational identities to critical workflows Inventory service accounts, API keys, and automated access paths used by logistics, warehouse, and fleet systems.
- Use hybrid testing for high-change environments Blend internal assessments with external researcher input where business systems change too quickly for annual or quarterly tests to stay current.
What's in the full article
INTIGRITI's full article covers the operational detail this post intentionally leaves for the source:
- How the authors position bug bounty programs as a continuous testing option for transport and logistics environments.
- The hybrid pentesting model they describe, including how pay-for-impact changes testing economics.
- The sector examples and business disruption context behind the move away from periodic pentesting.
- The practical reasons the article gives for treating cybersecurity as a core operational function in T&L.
👉 Read INTIGRITI's analysis of continuous security testing for transport and logistics →
Transport and logistics cyber defence: why pentests are not enough?
Explore further
21/08/2026 5:08 pm
Continuous testing is becoming a resilience control, not just a security testing choice. In connected logistics environments, the old model assumes the risk picture is stable enough to sample periodically. That assumption fails when integrations, devices, and permissions change faster than the next test window. The practical conclusion is that continuous validation belongs in operational governance, not only in security assurance.
A question worth separating out:
Q: What should teams do when a logistics cyber issue affects operations and finance together?
A: Contain the affected systems, isolate partner connections that may extend the blast radius, and review privileged access paths before restoring services. In logistics, operational and financial processes are often linked, so recovery should confirm both process integrity and identity scope before normal traffic resumes.
👉 Read our full editorial: Continuous security testing is exposing the limits of T&L pentests
