Penetration Testing Crucial in Combatting Cyber Attacks, Warns Security Expert
London, October 22 2024 – As cyber attacks continue to plague businesses, Keith Poyser, Vice President for EMEA at security company Horizon3.ai, is speaking out about the importance of regular penetration testing in order to effectively combat them. Poyser cautions that blindly relying on cyber defence systems without actively testing them is a naive approach. He explains, “You only know how resilient an IT network really is to cyber attacks if you put it to the test. Only penetration tests can determine whether hackers can penetrate from the outside or whether an organisation is actually protected against cyber criminals.”
Poyser’s warnings are supported by the Government’s Cyber Security Breaches Survey 2024, which reveals that 50% of businesses experienced a cyber breach or attack in the past 12 months. The numbers are even higher for medium and large enterprises, reaching 70% and 74% respectively. Despite implementing key security measures, such as anti-malware, EDR, DLP, password policies, backups, and firewalls, Poyser warns that organisations often underestimate the vulnerabilities that exist within their systems. These can include social engineering, unpatched software, misconfigurations, poor credential security, and insider threats.
Poyser emphasizes, “Many organisations rely on dozens of cyber defence tools, assuming they are fully protected against external and internal attacks. But this is like flying blind, trusting that everything will work perfectly without active testing. And human-led testing only delivers a static snapshot of a small part of the estate. It may work in calm conditions, but it’s naive to think that a purely defensive strategy can withstand the relentless and evolving nature of modern cyber threats.” To effectively defend against cyber attacks, Poyser urges organisations to adopt a more proactive, automated penetration testing approach. This not only better safeguards their systems, but also provides a better return on investment from existing security tools. It also allows companies to show their boards that they are “more secure this week than last week,” which is crucial for meeting compliance and regulatory requirements.
Human Risk Must Not Be Neglected
While identifying technical vulnerabilities and software flaws is critical, Poyser also warns against neglecting the human factor. According to the Government’s Cyber Security Breaches Survey 2024, a staggering 95% of cyber attacks succeed because of human error, such as opening phishing emails or using weak passwords. Poyser stresses that both technical and human vulnerabilities must be addressed in order to ensure a comprehensive cyber defence. He explains, “Hackers generally analyse all publicly available information about a company, its employees and even former employees on social networks, in order to track down security-relevant information.”
He also cites “configuration errors due to ignorance or oversight in the defence systems” as another frequently encountered consequence of human weaknesses. “With a myriad of security programmes running at the same time, organisations have often lost track of their associated configurations. The need to constantly update security software alone can be overwhelming for many corporate IT teams, not so much in terms of expertise, but in terms of workload. With each update, the entire configuration has to be re-examined, as the interaction of different systems can lead to new vulnerabilities as soon as one component changes even slightly.”
In light of these challenges, Poyser recommends that organisations adopt autonomous penetration testing platforms, which offer a safer and more cost-effective solution than relying on traditional teams of experts. He clarifies, “Of course, we still need as many highly qualified specialists as possible, but at the same time we need to increase the level of automation in penetration testing as much as possible in order to cope with the constantly growing threat situation.”
A Shift in Perspective: The Key to Effective Security
To effectively safeguard against evolving threats, Poyser emphasizes the importance of regular and comprehensive penetration testing. This includes not only testing the external perimeter of IT networks, but also the internal security. As more devices connect to company networks from external locations, the potential attack surface increases. Poyser explains, “Modern security strategies must assume that hackers will breach the outer defences and gain initial access to a network segment, from which they can then launch internal attacks.”
Even the so-called ‘demilitarized zone’ (DMZ), commonly considered a secure area, is no longer safe, according to Poyser. “A modern penetration test can examine the entire company network in all its ramifications, including internal, external, and cloud attack surfaces,” he emphasizes. “It’s not just about identifying vulnerabilities, but also assessing their potential impact. For instance, if a break-in to the DMZ exposes the entire network to a hacker, a thorough penetration test will highlight this risk, allowing for immediate and targeted remediation. Repeated automated tests will allow you to find, fix, and verify.”
Poyser’s work with Horizon3.ai, which offers
Derick is an experienced reporter having held multiple senior roles for large publishers across Europe. Specialist subjects include small business and financial emerging markets.