THE STATE OFPENTESTING 2023
SURVEY REPORTTABLE OF CONTENTSEXECUTIVE SUMMARY
Introduction

2

Methodology

2

Key Findings

3

SURVEY REPORT FINDINGSDefense in Depth Is Not Sufficient Anymore

5What’s Driving Pentesting?

7

How are Pentest Reports Being Used?

8

Tested Aspects During Pentesting Assessment

9

Biggest Barriers to Pentesting: Percieved Risk to Business Continuity and a Talent Shortage

10

Current Economic Slowdown is Not Impacting Cybersecurity Budgets

11

Projected Annual IT Security and Pentesting Budgets

12

Pentesting is Standard, But There is Room for Improvement

13

The Validation vs. Change Rate – Frequency Gap

15

A Detailed Look at the Numbers Behind this Report

16

About Pentera

25

THE STATE OF PENTESTING SURVEY 2023

INTRODUCTION
Pentera, the leaders in Automated Security Validation, undertook this research to understand the current
state of security validation in organizations of different sizes across Europe and the USA.
How are today’s organizations approaching pentesting, compared to common practices a few years
ago? What are the motivations driving pentesting? And how is the current economic situation impacting
cybersecurity - both specifically for pentesting initiatives and for the wider IT security budget?
This report is a snapshot of how security leaders in 2023 perceive and choose to adopt security validation
strategies, shining a light on budget, sentiment, drivers, and inhibitors for their current practices.

METHODOLOGY

300
1000+

We commissioned a survey of 300 security
executives who hold VP or C-level positions
in companies with more than 1,000 employees.
Respondents were split between the U.S., the UK,
and Western Europe. We screened for those who
were aware of their pentesting activities, and how
frequently they implemented manual pentests,
if at all. This report was administered online by
Global Surveyz Research, a global research firm.

THE STATE OF PENTESTING SURVEY 2023

The respondents were recruited through a global
B2B research panel, invited via email to complete
the survey, with all responses collected during
December 2022.

The average amount of time spent on the survey
was 6 minutes and 44 seconds. The answers to
the majority of the non-numerical questions wererandomized, in order to prevent order bias in theanswers.

This report was administered online by Global
Surveyz Research, a global research firm. The
respondents were recruited through a global B2B
research panel, invited via email to complete
the survey, with all responses collected during
December 2022.

2

KEY FINDINGS01
DESPITE LARGE INVESTMENTS IN DEFENSE-INDEPTH STRATEGIES, 88% OF ORGANIZATIONSREPORT RECENT ATTACKS
On average, companies have almost 44 security solutions
in place, indicating a defense-in-depth strategy, wheremultiple security solutions are layered to best protect
critical assets. However, despite the large number of
security solutions implemented, 88% of organizations
admit to being compromised by a cyber incident overthe past two years.

44

SECURITY
SOLUTIONS

02
CYBERSECURITY BUDGETS AREN’T IMPACTEDBY THE FINANCIAL SLOWDOWN
Despite the recent global economic slowdown,
cybersecurity budgets are not expected to be impacted
in 2023. 92% of organizations report a raise in their
IT security budgets, and 85% report a raise in theirpentesting budget specifically.

88%

COMPROMISED BY
A CYBER ATTACK

92%
RAISING THEIROVERALL
IT SECURITY
BUDGETSTHE STATE OF PENTESTING SURVEY 2023

3

KEY FINDINGS

03

04

05

THE IMPORTANCE OF CYBER INSURANCE HAS
SKYROCKETED FOR SECURITY EXECUTIVESTHE DRIVERS FOR PENTESTING HAVE EVOLVEDBEYOND REGULATIONSRISK TO BUSINESS CONTINUITY IS THE BIGGESTBARRIER TO PENTESTING

The global discussion around the evolution of cyber
insurance requirements has taken center stage as thenumber of attacks increased throughout the Covid-19
pandemic. Cyber insurance assessment is becoming a
critical driver for pentesting, with 36% of respondents
naming it as their top reason for conducting pentesting
compared to only 2% who listed it as a primary
motivation in a similar survey that was conducted
towards the beginning of the pandemic in 2020.

While the need for pentesting originated withregulatory requirements, the top-of-mind motivations
for pentesting today are security validation, potential
damage assessment, and cyber insurance. With only
22% of respondents citing compliance as their primary
motivation for the practice, regulatory or executive
mandates are still impactful, but not the primary
rationale driving pentesting.

While the practice of pentesting is already ubiquitous,
with 82% of companies today already pentesting insome form, the primary barrier for the practice is thefear for business continuity. Companies who are alreadypentesting, and those who do not pentest at all, cite therisk to business continuity as the largest concern when
considering adopting a greater amount of pentests, witha lack of available pentesters as the second largest issue.

36%

22%

82%

CYBER INSURANCETOP REASON FORCONDUCTINGPENTESTING

THE STATE OF PENTESTING SURVEY 2023

CITINGCOMPLIANCE AS
THEIR PRIMARY
MOTIVATIONCOMPANIES
ALREADY
PENTESTING IN
SOME FORM

4SURVEY REPORT FINDINGSDEFENSE IN DEPTH
IS NOT SUFFICIENT ANYMORE
Defense-in-depth (DiD) is a security strategy wheremultiple security technologies are layered on top of one
another, working with the assumption that no single tool
can keep an organization fully secure. Instead, the DiD
methodology states that layering security from multiple
directions will best protect critical assets.

33%
28%

Research shows that 92% of organizations utilize a
DiD strategy. Our data reiterates the focus on DiD, as
respondents are currently investing in an average of
43.8 security solutions, and only 6% have less than ten
tools in place.

22%

10%

-10

92%

ORGANIZATIONSUTILIZE A DIDSTRATEGY

43.8
SECURITY
SOLUTIONS

6%

6%
2%

LESS THANTEN TOOLSIN PLACE
0-10
Solutions

THE STATE OF PENTESTING SURVEY 2023

11-20
Solutions21-50
Solutions

51-75
Solutions76-100
Solutions101+
Solutions5

>> SURVEY REPORT FINDINGS

However, despite this strategy, 88% of respondents
have admitted to being compromised by a cyberattack over the past two years, with 45% reporting an
attack in the past 12 months. Based on our findings,
it’s clear that the current DiD strategy is not sufficient
towards preventing cyber breaches.

No Breach

12%

45%

Reporteda breachin the past
two years

88%
IN PAST 24 MONTHS

55%
USA

Breachedin the past
12 months

Breachedin the past
24 months

43%

57%

IN PAST 12 MONTHS

32%
U.S.

EUROPEAN ORGANIZATION REPORTEDA BREACH IN THE PAST YEAREUROPE32%

THE STATE OF PENTESTING SURVEY 2023

We can see that in 2021, cyber attacks were morecommon for U.S. organizations than those in Europe,(55% and 32% respectively). However, in 2022, theonslaught of attacks trended towards Europe, and 57%
of European respondents reported a breach, compared
to 32% in the U.S.

57%

EUROPE

6

>> SURVEY REPORT FINDINGSWHAT’S DRIVING PENTESTING?
We asked security leaders why they conduct pentestingin their organization to find out what’s driving thepractice.
What we found is that while pentesting originated from
regulations and compliance, security validation is now
the primary driver for the practice.
The top reasons that companies perform pentesting
for are to validate their cyber security controls, and toassess the potential damage of a successful attack,both named by 41% of respondents.
While this focus on control and validation has remained
unchanged from our previous survey, The State of
Penetration Testing 2020, other drivers show a marked
shift over the past two years.
In 2020, the second most-common reason for pentesting
was to satisfy regulatory compliance, which is the originof pentesting as a security practice. As shown in thedata, regulatory compliance has since fallen in priority to
the least critical driver in todays’ pentesting discussion
with only 22% listing it as a top reason for the practice.

41%

CYBER
SECURITYCONTROL AND
VALIDATION

41%

ASSESS THE
POTENTIAL
DEMAGE OF A
SUCCESFULATTACK36%

CYBER
INSURANCEREQUIREMENTS

22%

REGULATORYCOMPLIANCE

As regulatory compliance has moved down the list of priorities, cyber insurance has taken leaps in the opposite direction.
In 2020, only 2% of respondents named cyber insurance as a reason to adopt pentesting, while today this is a top driverfor 36% of respondents. Cyber insurance has become a major factor in security decision making.

Question allowed more than one answer and as a result, percentages will add up to more than 100%

THE STATE OF PENTESTING SURVEY 2023

7

>> SURVEY REPORT FINDINGSHOW ARE PENTEST REPORTS
BEING USED?

47%

We asked CISOs how they utilize the reports they receiveat the end of pentesting assessments. While the top
response is to immediately transfer the information to
IT so that they can remediate issues (47%), pentesting
reports are also being used for communication, bothinternally and externally.

IMMEDIATELY
TRANSFER TO
IT SECURITY

47%
43%
38%
30%
20%
9%

CISOs are utilizing pentesting reports as a more concrete
way to communicate risk to the board of directors or toother executives within the organization who may not
be as security-saavy. They also share pentesting reports
with customers and regulators, providing assurances
to these stakeholders that the security posture of theorganization is robust.

IMMEDIATELY TRANSFER TO IT SECURITYSUBMIT TO THE BOARD OF DIRECTORSSHARE WITH EXECUTIVE COLLEAGUESSHARE WITH CUSTOMERSSHARE WITH REGULATORSARCHIVE3%

USE A PAPER WEIGHT
Question allowed more than one answer and as a result, percentages will add up to more than 100%

THE STATE OF PENTESTING SURVEY 2023

8

>> SURVEY REPORT FINDINGSTESTED ASPECTS DURINGPENTESTING ASSESSMENT
Penetration testing spans all aspects of the modern
attack surface as a sampling exercise. Interestingly,
the top tested aspects during pentesting assessments
include cloud infrastructure & services (44%), externalfacing assets (41%), and core network (40%).
Check Point Research has reported a dramatic spike incloud network attacks during 2022. They uncovered a
48% increase in the number of attacks per organization.
Our informed assumption is that the cloud environmentis where many CISOs feel they have the least visibility
and maturity, and therefore, this is where they choose toplace their pentesting focus .

Cloud infrastructure & services

44%
External facing assets

41%
Core network

40%
Applications

36%
Active Directory & password assessment

21%

Question allowed more than one answer and as a result, percentages will add up to more than 100%

THE STATE OF PENTESTING SURVEY 2023

9

>> SURVEY REPORT FINDINGSBIGGEST BARRIERS TOPENTESTING: PERCIEVED RISKTO BUSINESS CONTINUITY
AND A TALENT SHORTAGE
When we asked respondents to name the main
inhibitors for implementing pentesting or increasing
their use of pentesting, the perceived risk to business
continuity stood out as a core concern.
45% of those who already conduct pentesting, whether
manual or automated, say that the risk to businessapplications or network availability prevents them fromincreasing the pentesting frequency, and this number
increases to 56% when we look at those who don’t
conduct pentesting assessments at all. Availabilityof pentesters is the second largest concern for bothgroups. It’s likely that many, if not most, organizations
who engage in pentesting have suffered an network
disruption as a result at some point, and the institutional
memory of such incidents is strong. Businesses want
to feel that they are working with the most experienced
pentestersusing the highest quality pentesters who
are least likely to impact business continuity. This will
reduce the risk of business disruption or downtime, their

number one fear.
Interestingly, budget does not appear to be a top-ofmind concern. Only 33% of the CISOs name budget as areason not to increase the frequency of pentesting, andonly 25% of those who don’t pentest at all cite budget asa factor. While not the main concern for organizations,
it is interesting to note that regionally, US respondents
are more concerned with budget compared to their
European counterparts.

INHIBITORS FOR DOING MORE FREQUENTMANUAL PENTESTING ASSESSMENTS

REASONS FOR NOT CONDUCTING PENTESTINGASSESSMENTS

45%
41%
33%

41%
U.S.

25%
EUROPE

Afraid of risk to
Business continuity

Afraid of risk to
Business continuity

Availabilityof Pentesters

Availability ofManual Pentesters

Budget21%

Regulatory Mandates
don’t require more

21%

Don’t have the internal
resources to remediate4%

We don’t
need more testing

56%
44%

Don’t have the internal
resources to remediate

31%
25%

BudgetNot a regulatory
requirment

13%

I don't believe
we need Pentesting9%

Question allowed more than one answer and as a result, percentages will add up to more than 100%

THE STATE OF PENTESTING SURVEY 2023

10

>> SURVEY REPORT FINDINGSCURRENT ECONOMICSLOWDOWN IS NOT IMPACTINGCYBERSECURITY BUDGETS
The average annual pentesting budget in 2022 was$208,224, with 77% of security leaders reporting apentesting budget of more than $100,000.
This is a dramatic increase from 2020, where ourprevious survey revealed that 49% of enterprises hada pentesting budget of less than $100k.
When broken down by region, the average annual
pentesting budget in Europe ($210,885) is slightly higher
than in the U.S. ($205,947). The breakdown by company
size shows that the average annual budget of companies
with under 5K employees is $196,430, compared to the$228,777 of companies with more than 5K employees.
What we see is that neither region nor company size
appears to significantly impact the size of pentesting
budgets.

$10K-$50K$208K

AVERAGE ANNUAL PENTESTING BUDGET

40%$100K-$250K

35%$250K-$500K

2%$228,777$205,947$195,430

EuropeTHE STATE OF PENTESTING SURVEY 2023

19%$50K-$100K$500K+$210,885

3%

U.S.

<5K
5K+
Employees Employees

11

>> SURVEY REPORT FINDINGSPROJECTED ANNUAL
IT SECURITY ANDPENTESTING BUDGETS
Both pentesting budgets and overall IT security budgets
increased significantly for 2023. 92% of CISOs report anincrease in their IT security budget in 2023, and 85% of
respondents say that their annual pentesting budget has
increased as well.
** Note - the survey responses were gathered in
December 2022, when budgets for 2023 had been
decided and approved.

PROJECTEDOVERALL IT
SECURITY
BUDGET

PROJECTEDANNUALPENTESTINGBUDGET

Increase byless than 10%

Increase byless than 10%

56%

56%

INCREASE

INCREASE

92%

85%
Increase by
more than 10%

Increase by
more than 10%

29%

36%

According to a Gartner® Press Release, "Spending
on information security and risk management
products and services is forecast to grow 11.3%
to reach more than $188.3 billion in 2023." *There are regional differences to be aware of. Whilealmost every company is reporting budget increases,
European respondents report larger projected budgetary
growth over the next year compared to the U.S.
42% of respondents from Europe say that theirpentesting budget will increase by more than 10% in
2023, compared with just 17% of security leaders fromthe U.S. The same dynamic appears when we look at
the budget for overall IT security, with 44% of European
companies increasing their budget by more than 10%,against just 28% of those from the U.S.

THE STATE OF PENTESTING SURVEY 2023

INCREASE OVERALL IT BUDGETS
BY LESS THAN 10%

INCREASE OVERALL IT BUDGETS
BY MORE THAN 10%

59%

28%
44%

52%

U.S.

EuropeGartner Press Release, Gartner Identifies Three Factors Influencing Growth in Security Spending, October 13, 2022, https://www.gartner.com/en/newsroom/press-releases/2022-10-13-gartner-identifies-three-factors-influencing-growth-i.. GARTNER is a registered trademark and service mark of Gartner, Inc.
and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved

12

>> SURVEY REPORT FINDINGSPENTESTING IS STANDARD,BUT THERE IS ROOM FOR
IMPROVEMENT
Pentesting is already a standard practice, but 62%
of respondents recognize that there is room for
improvement in their pentesting processes and themarket is building towards in-house capabilities.

62%

42%

SEE ROOM FOR
IMPROVEMENT
IN THEIRPENTESTING
EFFECTIVNESSAt the end of 2022, 82% of CISOs reported that they are
conducting pentesting as part of their overall security
strategy, however, only 42% report using an external
party. 39% have in-house pentesting capabilities,
for independence, efficiency and greater validation
frequency. Still there is room for growth as only 15%
are on the advanced end of the security validation
maturity scale and are also using automation tools to
conduct pentesting.

THE STATE OF PENTESTING SURVEY 2023

39%

18%

Not doing
pentesting

15%

Using 3rd-party
service providers

Internal
manually

Using automatedPentesting software

13

>> SURVEY REPORT FINDINGS

Our 2020 report reveals that 51% of CISOs reported
in-house red-teams, and that number has grown to 67%
today. More impressive than the growth, however, is that
96% of security executives reported that by the end of2023 they will already have, or plan to have, an in-house
red team for this critical task.

96% HAVE OR WILL HAVE IN-HOUSE RED-TEAM
Negligible
or no effect4%Veryeffective
38%

Somewhateffective
58%
COSTEFFECTIVENESS
OF MANUALPENTESTING FOR
SECURITY
IMPROVEMENTTHE STATE OF PENTESTING SURVEY 2023

We don’t havean in house team4%

We have an
in-house team
67%

96%

No, but
planning tohave in 2023
29%

EXPECT TO
HAVE IN-HOUSE
RED-TEAMSBY END OF 2023

14

>> SURVEY REPORT FINDINGSTHE VALIDATION VS. CHANGE RATE – FREQUENCY GAP
The push towards in-house capabilities likely stems from the need to validate the security of IT environments that are
evolving faster than the current testing cadence and attack surfaces that are being assessed. 70% of the CISOs reportthat their IT environment is being updated with assets being added or removed on a quarterly, monthly or weekly basis.
However, 82% of the CISOs reported that they test their network on a quarterly to annually basis. It is clear that there isa frequency gap between the change rate and the validation rate, leaving IT infrastructure untested for long periods oftime or untested completely.

29%

HOW OFTEN ARE YOU ADDING/SUBTRACTINGASSETS TO/FROM YOUR NETWORK?

13%

ANNUALLYTESTING

21%

16%

BIANNUALLY

32%

36%

QUARTERLY

11%
8%

14%

WEEKLYDAILY

THE STATE OF PENTESTING SURVEY 2023

20%

MONTHLY

CHANGEHOW OFTEN DOES YOUR ORGANIZATION CONDUCTMANUAL PENTEST ASSESSMENTS?

0.3%

15

DEMOGRAPHICS | A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORTINDUSTRIES OF RESPONDENTS

16%

11%

9%

8%

7%

6%

6%

6%

5%

4%

Goverment

Energy& Utillites

Retail &eCommerce

Banking

Education

Financial
Services

Health& PharmaTransport& Logistics

Food

Travel &Hospitality

4%

4%

3%

3%

2%

2%

2%

1%

1%

1%

Information
Technology

Media

Professional
Services

TelecomTechnology

Industrial

Insurance

SoftwareDevelopment

Agriculture& Mining

PublicServices

16%

RESPONDENTS ARE BASED IN
50%
USA

UK

16%
GERMANY

16%
FRANCETHE STATE OF PENTESTING SURVEY 2023

16

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORTSIZE OF ORGANIZATIONS

IT

44%

42%

51%
MID-SIZED
1K-5K EmployeesCYBER
SECURITY

LARGE
5K-10K Employees

7%

X-LARGE
10k+ Employees

56%

DEPARTMENT

CIO

CISO

10%

49%
ROLE
Information
Security

10%

VP/ HEAD

C-SUITE

41%

59%

JOB SENIORITY

THE STATE OF PENTESTING SURVEY 2023

17

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORTHOW MANY SECURITY
SOLUTIONS DO YOU
CURRENTLY USE ACROSSYOUR ORGANIZATION?

HAS YOUR ORGANIZATIONBEEN COMPROMISED BY
A CYBERATTACK OVER
THE PAST 24 MONTHS?

No Breach

Breachedin the past
12 months

12%

45%

33%

88%

REPORTEDA BREACH IN THE
PAST TWO YEARS

28%

Breachedin the past
24 months

43%

22%

IN PAST 24 MONTHS

55%

IN PAST 12 MONTHS

32%
U.S.

U.S.

10%

6%
2%

0-10
Solutions

11-20
21-50
51-75
Solutions Solutions Solutions

76-100101+
Solutions Solutions

THE STATE OF PENTESTING SURVEY 2023

EUROPE

32%

57%

EUROPE

18

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORT

WHAT ARE THE MAIN REASONSYOUR ORGANIZATION CONDUCTSPENTESTING?

WHAT DO YOU DO WITH YOURPENTEST REPORT?

WHAT ASPECTS OF YOURORGANIZATION ARE YOUTESTING DURING A PENTESTINGASSESSMENT?

Cyber security control and validation

Immediately transfer to IT security

Cloud infrastructure & services

47%

41%
Assess the potential damage of a successful attack

41%

Submit to the board of directors

43%
38%
30%
20%

Regulatory complianceCore network
40%

Applications
36%

Share with regulators

Executive mandate

25%

41%

Share with customers

Prioritize security investments

28%

External facing assets

Share with executive colleagues

Cyber Insurance requirement

36%

44%

Archive

Active Directory & password assessment
21%

9%
Use a paper weight

22%

THE STATE OF PENTESTING SURVEY 2023

3%

19

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORT

WHY ARE YOU NOT CONDUCTING
MANUAL PENTESTINGASSESSMENTS MORE OFTEN?

REASONS FOR NOT CONDUCTINGPENTESTING ASSESSMENTS

Afraid of risk to Business continuity

Afraid of risk to Business continuity

45%

56%

Availability of Pentesters

Availability of Manual Pentesters

44%

41%
Budget33%
Regulatory Mandates don’t require more

41%
U.S.

25%

Don’t have the internal resources to remediate

31%

EUROPE

Budget21%
Don’t have the internal resources to remediate21%
We don’t need more testing

4%

25%
Not a regulatory requirment

13%
I don't believe we need Pentesting

9%

THE STATE OF PENTESTING SURVEY 2023

20

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORTYOUR ANNUAL *OVERALL* IT
SECURITY BUDGET FOR 2023 IS
DUE TO?

YOUR ANNUAL *PENTESTING*
BUDGET FOR 2023 IS DUE TO?

ANNUAL OVERALL IT BUDGETDUE TO? SPLIT BY REGION

Increase by
more than 10%

Increase by
more than 10%

56%

56%

INCREASE
92%

INCREASE
85%
Increase byless than 10%

Increase byless than 10%

29%

36%

Europe
U.S.

59%
52%

44%
Remainunchanged
year-over-year

Remainunchanged
year-over-year

7%

12%

Decrease byless than 10%

Decrease byless than 10%

1%

3%

THE STATE OF PENTESTING SURVEY 2023

28%

INCREASE BY
LESS THAN 10%

INCREASE BY
MORE THAN 10%

21

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORT

WHAT IS YOUR CURRENT ANNUAL
BUDGET FOR *PENTESTING*?

35%

40%

2%
3%

WHAT IS YOUR CURRENT ANNUAL
BUDGET FOR *PENTESTING*?

WHAT IS YOUR CURRENT ANNUAL
BUDGET FOR *PENTESTING*?

SPLIT BY REGIONSPLIT BY ORGANIZATION SIZE

20%$210,885

40%$100K-$250K

35%$250K-$500K

20%$50K-$100K

3%$10K-$50K

2%$500K+$205,947$195,430

EuropeTHE STATE OF PENTESTING SURVEY 2023

$228,777

U.S.

<5K
5K+
Employees Employees

22

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORTARE YOU DOINGPENTESTING TODAY?

42%

OVERALL, HOW COSTEFFECTIVE ARE YOURMANUAL PENTESTINGEFFORTS TOWARDSIMPROVING YOURSECURITY OVER TIME?

39%

18%

Negligible
or no effect4%Veryeffective
38%

Somewhateffective
58%
COSTEFFECTIVENESS
OF MANUALPENTESTING FOR
SECURITY
IMPROVEMENT

15%

DO YOU HAVE AN INHOUSE RED TEAM OR
PENTESTING TEAM?
Not doing Using
pentesting 3rd-party
serviceprovidersInternal
manually

Using
automated
Pentesting
software

THE STATE OF PENTESTING SURVEY 2023

We have an
in-house team67%

We don’t havean in house team
4%

96%

No, but
planning tohave in 2023
29%

EXPECT TO
HAVE IN-HOUSE
RED-TEAMSBY END OF 2023

23

>> A DETAILED LOOK AT THE NUMBERS BEHIND THIS REPORTHOW OFTEN DOES YOURORGANIZATION CONDUCT MANUALPENTEST ASSESSMENTS?

HOW OFTEN ARE YOU ADDING/SUBTRACTING ASSETS TO/FROMYOUR NETWORK?

36%

32%

29%

21%

20%
16%

14%

13%

11%
8%

0.3%
Daily

Monthly

Quarterly Biannually

Annually

THE STATE OF PENTESTING SURVEY 2023

Annually

Biannually QuarterlyMonthly

WeeklyDaily

24

PENTERA'S
AUTOMATED SECURITY
VALIDATION PLATFORM
The Pentera Platform automatically uncovers real
exposures in the organization’s IT environment.
Pentera uses an adaptive, rule-based, algorithm toscan and challenge the entire attack surface (Internaland External), providing real-time security validation atscale. Pentera safely performs the actions a malicious
adversary would — reconnaissance, sniffing, spoofing,
cracking, (harmless) malware injection, file-less
exploitation, post-exploitation, lateral movement,
and privilege escalation — all the way to data exfiltration.
Requiring no agents or pre-installations, the platform
gives security teams a complete attack operation viewthat provides a true assessment of their resiliency
against real attacks, prioritizing remediation efforts
with a threat-facing perspective. Pentera applies thelatest hacking techniques, including ransomware strains
and leaked credentials, enabling organizations to focus
their resources on the remediation of the vulnerabilities
that take part in a damaging “kill chain”.
With Pentera, organizations continuously reduce cyber
exposure and maintain the highest resilience postureby performing validation tests as frequently as needed daily, weekly, or monthly. This gives companies a bettergrasp not only of their security gaps but also allows themto test the efficiency of the security stack and maintainconsistency across the organization.
THE STATE OF PENTESTING SURVEY 2023

ABOUT PENTERA
Pentera is the category leader for Automated Security
Validation, allowing every organization to test withease the integrity of all cybersecurity layers, unfolding
true, current security exposures at any moment,at any scale. Thousands of security professionals andservice providers around the world use Pentera to guide
remediation and close security gaps before they are
exploited. For more info, visit: pentera.io