Future Market Trends

In many organizations, security testing is typically conducted in isolated silos, disconnected from one another. While continuous security testing aims to catch vulnerabilities before they are exploited, there is even greater value in adopting a more collaborative approach.

Read on to discover how a more holistic approach to security testing can help organizations stay ahead in an ever-evolving threat landscape.

The current state of the sector

Continuous security testing (CST) in some form has been around since the early 2010’s however until recently it has still been a time-bound disjointed activity.

Previously it was not uncommon to see CST packaged up as nothing more than a monthly vulnerability scan and a quarterly penetration test.

CST now exists as an established solution across multiple vendors, where businesses can now expect testing to be happening daily and be heavily supported by human penetration testers.

Whilst this is a shift in the right direction, there are still shortcomings in the present solutions. Continuous security testing comes largely from the perspective of a real world attacker, attempting a range of TTP’s to establish a foothold on a network.

This is certainly a worthwhile exercise, however within enterprise environments new vulnerabilities and in turn attack paths appear almost daily and far exceed the rate at which an Adversary focussed continuous testing programme can manage efficiently.

So, where the market is headed in the short and medium terms?

As an emerging market, innovation is happening across the landscape.

However, We have identified three core themes:

1. Bug hunting vs analyst approach: Ultimately when folding humans into any continuous solution there are multiple options in which to do so. In the case of security testing we see Two primary methods.The first is take advantage of the gig economy around the world and reward them for finding bugs.The second is to instead emulate defensive security and dedicate testers to a specific business for a period of time.Each of these methods has benefits as well as drawbacks and we are still to determine which will be most effective long term.

1. Integration: Manual security testing has long operated as an island off the coast of a businesses technical ecosystem. We the rise of a platform first approach it presents an opportunity to integrate seamlessly. Some obvious benefits include: reporting bugs directly into a ticketing system, taking telemetry from security tools to aid testing, notification of vulnerabilities or tasks completed into slack or Teams.
2. Decision Intelligence: Knowing when and where to test in order to have the best chance of findings vulnerabilities has long been a mystery. Businesses might hold this information because they have just released a new feature or a new vulnerability has been released on technology they know exists in their environment. With the technological advancements in artificial intelligence and machine learning it is now possible to use technology to direct testing. By taking feeds from ticketing systems (JIRA), and code repos as well as new vulnerability and threat intelligence feeds, a continuous testing solution can detect issues much more efficiently than ever before.