Fortra Penetration Testing Report 2024

Keypoints

1. Major cybersecurity vendors publish comprehensive annual reports that typically include sections on threat landscape, emerging attack techniques, vulnerability statistics, assessment methodologies, and strategic recommendations for organizations.
• 2. These reports often feature statistics such as the percentage of organizations using pen testing for breach prevention (82%), with a significant increase in the use of pen testing for compliance and internal mandates, reflecting its strategic value.
• 3. Key trends highlight persistent threats like phishing (80%) and ransomware (72%), driven by low entry barriers on the dark web and the rise of AI-generated attack methods, making these threats more pervasive and sophisticated.
• 4. Common challenges include resource shortages (62%) and skills gaps (34%), which hinder effective vulnerability remediation and consistent penetration testing practices.
• 5. Reports stress the importance of combining tools such as vulnerability scanners, red teaming, and security awareness training to create a layered, proactive defense system.
• 6. An increasing emphasis is observed on vendor consolidation (84%), with organizations favoring trusted vendors offering integrated security solutions, including pen testing, to simplify management and improve security maturity.
• 7. The frequency of pen testing varies based on organizational size and complexity, with many recognizing the importance of retesting to validate remediation efforts, but practical constraints often limit testing initiatives.
• 8. Use of third-party pen testing services remains high (92%), driven by their objective perspective and up-to-date threat knowledge, though challenges in selecting qualified providers persist.
• 9. The adoption of tools, such as commercial pen testing solutions, is driven by needs for detailed reporting, automation, and threat intelligence, with a notable shift toward open-source tools due to budget constraints.
• 10. Other assessment solutions like vulnerability scanners, security awareness programs, and application security testing are widely adopted, supplementing pen testing to enhance overall security resilience.
• 11. Red teaming remains less common (41%) but is valued for its realistic simulation capabilities; organizations with advanced maturity are more likely to leverage these services effectively.
• 12. The report underscores that evolving regulations (e.g., PCI DSS, NIS2, DORA) are expanding pen testing scope, emphasizing the need for adaptive assessment strategies across environments like web applications and cloud infrastructures.