At its simplest, the goal of offensive testing – and penetration tests in particular – is to identify vulnerabilities within an environment and provide remediation guidance. However, many organizations view offensive testing as a performance review, aiming to get a ‘top score’ with only a few findings.

This talk challenges that mindset, as it often distorts the true risk present in an organization – leading to a false sense of security when a “top score” is achieved. Instead, this talk reframes what a “successful” offensive test looks like. By taking a risk-based approach, offensive testing can prioritize systems tied to critical business risks – in turn ensuring that all findings truly buy-down risk.

Attendees will receive tactical guidance on how to extract the most value from their offensive testing to truly address the most pressing risks in their environment. Key topics include how to scope for impact by using a risk-based approach to prioritize systems for offensive testing and how to communicate findings in a Board-friendly manner to truly buy-down risk within the environment.