Topic starter
14/09/2026 10:09 am
TL;DR: Point-in-time testing can miss live exposure that appears after an assessment, according to Horizons.ai. Continuous validation gives teams evidence to retest Cisco and Active Directory issues and prove whether remediation actually reduced exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “Pentest Wednesday: Continuous Exposure Management”.
By the numbers:
- The company found more findings in 12 hours than a third-party engagement found in roughly 30 days.
Key questions
Q: Why do weak credentials create more risk when validation is infrequent?
A: Weak credentials become more dangerous when they are not continuously measured because teams cannot tell whether the exposure is isolated or systemic.
Q: How can security teams tell whether a fix actually reduced exposure?
A: They should test whether the original attack outcome can still be reproduced after remediation.
Q: What breaks when exposure management is only performed periodically?
A: The main failure is timing.
Practitioner guidance
- Instrument continuous retesting for identity-bearing changes Link exposure validation to infrastructure and identity changes so new web servers, keys, passwords, and service accounts are checked as soon as they appear.
- Validate exploitable exposure before prioritising remediation Use evidence of reachability and abuse potential to decide whether a weakness is urgent, rather than relying on severity labels or assumptions.
- Retest password and access policy changes Confirm that banned-password lists, length increases, and service-desk reset changes actually reduce cracked or similar passwords across the environment.
Bottom line: Point-in-time testing can miss exposure that emerges after the assessment, which is why continuous validation is becoming a governance issue as much as a security one.
Glossary terms: Continuous Threat Exposure Management, Assessment Cadence Gap, Identity-bearing Artefact, Evidence-Based Remediation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
14/09/2026 10:10 am
Continuous exposure management is becoming a governance model, not just a testing model. The article shows that the meaningful unit of control is no longer the annual pentest result, but the evidence loop between change, validation, remediation, and retest. For IAM and PAM teams, that shifts attention to when exposure appears and how quickly it is verified. Practitioners should treat evidence production as part of the control itself.
A question worth separating out:
Q: When should organisations prioritise continuous validation over point-in-time pen testing?
A: Prioritise continuous validation when code releases, infrastructure changes, or identity changes happen frequently enough that a quarterly test cannot keep pace. It is most useful when credentials, permissions, or business logic shift often, because those are the conditions where AI-assisted attackers can discover and exploit gaps faster than manual review cycles can respond.
👉 Read our full editorial: Continuous exposure management needs evidence, not periodic pentests