Every year, plenty of organisations buy a penetration test, receive a thick PDF
full of findings, file it for the auditors, and change almost nothing about
their actual security posture. The test happened. The risk didn’t move.
If you’re spending real money on offensive security, it’s worth understanding
why that gap exists — and how to close it.
A report is not an outcome
The deliverable everyone fixates on is the report. But a report is just a
snapshot of what one tester found in a fixed window of time. The outcome you
actually want is fewer exploitable paths into your environment. Those are not
the same thing, and conflating them is where most engagements quietly fail.
A few patterns I see repeatedly:
- Findings with no owner. A vulnerability that isn’t assigned to a specific
team with a specific deadline will still be open at the next test.
- CVSS as the only lens. A “medium” that chains into account takeover on a
payments flow matters more than a “high” on an internal box nobody can reach.
Business context beats raw scores.
- No retest. If remediation is never verified, you’re trusting that a fix
worked — which is exactly the assumption a test is supposed to remove.
What a good engagement looks like
The mechanics of the test matter less than what surrounds it. The engagements
that move risk tend to share a few traits:
- Clear, attacker-style goals agreed up front — “can we reach customer
funds?” beats “scan everything.”
- Findings prioritised by real impact, with attack chains spelled out so
engineers understand why something matters, not just that it scored high.
- A working session with the people who’ll fix it, not a report thrown over
the wall.
- A retest to confirm the fixes hold.
The point of an offensive engagement isn’t to prove you can be hacked. It’s to
give your defenders a prioritised, verified list of things that will make the
next attacker’s job harder.
The takeaway
Before you book your next test, ask the provider one question: what happens
after the report? If the answer is “we send it and invoice you,” you’re buying
a document. If the answer involves prioritisation, a working session and a
retest, you’re buying risk reduction.
That difference is the whole game.
Want a test that actually changes your risk?
Get in touch.
]]>