{"id":8138,"date":"2026-07-10T13:44:17","date_gmt":"2026-07-10T12:44:17","guid":{"rendered":"https:\/\/www.d2na.com\/?p=8138"},"modified":"2026-07-10T14:35:13","modified_gmt":"2026-07-10T13:35:13","slug":"a-focus-on-penetration-testing-part-1","status":"publish","type":"post","link":"https:\/\/www.d2na.com\/index.php\/2026\/07\/10\/a-focus-on-penetration-testing-part-1\/","title":{"rendered":"A Focus on Penetration Testing – Part 1"},"content":{"rendered":"<\/span> 3<\/span> mins read<\/span><\/span>\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Thinking differently about Pen Testing…<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Penetration testing<\/a> has traditionally been treated as an annual exercise. Book the test, receive the report, fix what you can, and move on until next year.<\/p>

But in today\u2019s cloud-first, Microsoft-centric and AI-enabled environments, risk does not wait twelve months. New services go live, integrations change, suppliers connect, permissions shift and attack surfaces evolve continuously.<\/p>

That is why organisations need to think differently about penetration testing. Not as a one-off compliance activity, but as part of an ongoing assurance model that helps validate controls, evidence compliance and give leaders confidence that digital services are secure today, not just when the last test was completed.<\/p>

In this three-part series we explore:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Part 1<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Why annual penetration testing is no longer enough<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Part 2<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

How to turn findings into meaningful risk reduction<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Part 3<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What continuous assurance looks like in practice<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Part 1: Why Annual Penetration Testing Is No Longer Enough<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Most organisations can tell you when their last penetration test took place. Far fewer can confidently say whether the controls protecting them today are still working as intended.<\/p>

In today’s environment, cyber risk evolves significantly faster than traditional testing cycles. Cloud platforms are continually updated, new integrations are introduced, AI-powered technologies are being adopted at pace, and users, suppliers and applications regularly change. Yet many organisations still rely on an annual penetration test to provide assurance for the next twelve months.<\/p>

For organisations delivering critical public services, this gap can create significant risk. NHS Trusts, Police Forces, Fire and Rescue Services and Local Authorities increasingly depend on digital services to support frontline operations, protect sensitive data and maintain public confidence. Small technology changes can have disproportionate impacts if security controls are not continually validated.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Pen\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Risk Is Moving Faster Than the Testing Cycle<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The uncomfortable truth is that a clean report from last year does not prove that today\u2019s environment is still secure. Every new service, integration, supplier connection or configuration change can alter the attack surface before the next annual assessment. New services are adopted, AI capabilities are introduced, cloud workloads are reconfigured and suppliers are connected.<\/p>

For organisations delivering critical public services, every change can alter the attack surface and introduce risk long before the next annual assessment.<\/p>

The shift required is cultural as much as technical. Penetration testing should no longer be viewed as a once-a-year event to satisfy an audit. It should become part of an ongoing assurance model where risk is reviewed, tested, remediated and evidenced throughout the year.<\/p>

This aligns closely with Microsoft\u2019s cloud security messaging. Microsoft\u2019s Cloud Adoption Framework describes cloud governance as a continuous process, supported by guardrails such as policies, procedures and tools that help organisations use cloud services productively while controlling risk. In a Microsoft environment, penetration testing should therefore sit alongside secure landing zones, identity controls, policy enforcement, configuration management and continuous monitoring.<\/p>

The goal is not to slow innovation. It is to give teams confidence to adopt cloud, AI and modern workplace services safely, with the right governance and guardrails in place.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Questions worth asking:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

If your organisation completed a penetration test six or twelve months ago, what has changed since then?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\n\n\t\t\n\t\t\n\n