Why does exposure grow faster than many organisations can assess it with traditional pentests?

Why This Matters for Security Teams

Traditional pentests still matter, but they are a snapshot of a moving target. Cloud accounts, CI/CD pipelines, secrets stores, service accounts, and agentic workloads can change daily, while pentest cadence is usually monthly or quarterly. That gap matters because exposure is not just about known CVEs. It also comes from exposed secrets, excess privilege, misconfigured access, and new externally reachable endpoints that appear between assessments.

NHI Management Group’s Ultimate Guide to NHIs — Why NHI Security Matters Now notes that 97% of NHIs carry excessive privileges, which helps explain why a small configuration change can expand blast radius quickly. The problem is amplified when teams assume that one successful test means the environment is still safe a week later. Current guidance suggests treating exposure as a continuous state, not a periodic finding.

In practice, many security teams discover the gap only after a leaked secret, shadow service account, or newly exposed API has already been exploited, rather than through intentional assessment coverage.

How It Works in Practice

Exposure grows faster than traditional pentests can assess it because the asset base is dynamic and the trust boundaries are porous. A pentest can validate a control set at a point in time, but it rarely keeps pace with the rate of change in cloud-native systems, ephemeral workloads, and automation-driven deployments. That is especially true for non-human identities, where one service account can be reused across apps, environments, and pipelines.

Practitioners are moving toward continuous discovery, continuous control validation, and continuous secret hygiene. The operational question is no longer “Was this secure during the test?” but “What changed since then, and what is now exposed?” That usually means combining external attack surface monitoring, cloud posture checks, and NHI visibility with shorter-lived credentials and tighter revocation. NHI Mgmt Group’s Guide to the Secret Sprawl Challenge is useful here because secret leakage often creates exposure long before a vulnerability scan does.

• Continuously inventory externally reachable services, identities, and secrets instead of relying on annual or quarterly reviews.
• Prioritise assets with excessive privilege, public reachability, or broad lateral movement potential.
• Use runtime context to separate noise from real exposure, especially for ephemeral cloud and CI/CD assets.
• Revoke or rotate high-risk secrets quickly when drift, leakage, or misuse is detected.

For broader threat context, Anthropic’s report on an AI-orchestrated cyber espionage campaign shows how automation can compress attacker timelines, which makes assessment lag more dangerous. These controls tend to break down when organisations have high deployment frequency but no authoritative inventory, because exposure changes faster than discovery can keep up.

Common Variations and Edge Cases

Tighter assessment cycles often increase operational overhead, requiring organisations to balance coverage against alert fatigue and engineering friction. That tradeoff becomes sharper in multi-cloud estates, ephemeral Kubernetes environments, and environments with many third-party integrations, where the same control can appear compliant in one scan and broken minutes later.

There is no universal standard for how much continuous testing is enough. Current guidance suggests using risk-based frequency: high-value internet-facing systems, privileged NHI paths, and secrets-heavy pipelines deserve more frequent validation than low-impact internal systems. This is also where the distinction between vulnerability management and exposure management matters. A finding may be low severity in isolation, but if it sits on a publicly reachable service account with excessive privileges, the real risk is much higher.

As NHI Mgmt Group documents in the 52 NHI Breaches Analysis, identity failures often become visible only after compromise has already occurred. The practical lesson is to treat pentests as one input, not the control plane for exposure. In environments with frequent IaC changes, unmanaged secrets, or outsourced admin access, even aggressive testing can lag behind the rate at which new attack paths appear.

Related resources from NHI Mgmt Group

• Should organisations use exposure metrics instead of traditional vulnerability counts?
• Why do traditional data security controls miss many AI-driven exposure paths?
• How should organisations implement compliance automation when AI systems are changing faster than traditional governance cycles can review them?
• What breaks when organisations rely only on manual pentests for ongoing exposure management?