Workshop Description:

Offensive testing – and penetration testing in particular – has become increasingly commoditized, with organizations increasingly narrowing scope, tightening timelines, and limiting access. As a result, it can be difficult – even for teams with top offensive security talent – to get executive buy-in for findings remediation or to demonstrate distinctive value from offensive testing.

This workshop enables offensive testing teams bridge this gap by using framing that will resonate: business risk. By taking a risk-based approach to critical phases of testing – planning, reconnaissance, reporting – offensive teams can gain buy-in and demonstrate distinctive value, tying all findings to risks that strategic decision makers will understand and prioritize.

In this workshop, we’ll explore tactical actions offensive teams can take to leverage this approach for each phase of testing. Attendees will receive tactical tips on how to quickly identify risks, leveraging existing Blue Team risk management documentation and threat modeling. Then, we’ll step through a case example to demonstrate how to incorporate risk into key phases of the testing process. Lastly, we’ll discuss how to frame findings in terms of risk, ensuring executive buy-in and tying findings to business value.