This is the second in a series of posts looking at the current state of pen testing as I see it and presenting some ideas for the future. Part one is available here.
In this post I will explore some of the issues I see in pen testing, it’s something of a rant that I have regaled a number of pen testing friends with over the last couple of years. If you disagree violently with this let me know, if I’ve missed something let me know, we need to open up this conversation in the industry.
In the next post I start exploring why these problems exist and how they might be improved.
What is wrong with pentesting?
As an informed customer, and an ex-pentester, I see a number of problems with pentesting as delivered today;
- Too much focus on 0day as a measure of success
- Too much variation in quality and coverage between testers and between tests
- Too much unexplained and undefined ‘black magic’
