Buying the Right Pentest and Protecting Your Brand

Using the Penetration Testing Buyer’s Guide to Get What You Need Without Getting Lost in the Jargon

Breaches happen when cybercriminals spot vulnerabilities before you do. In fact, data breaches have accelerated over the past few years, both in frequency and in magnitude. Five years ago, the largest breaches reached hundreds of thousands of records (typically less than 1M). Today, we’re seeing hundreds of millions of records exposed. The Equifax breach broke the 1B barrier and set a troubling record.

When breaches happen—in different industries, across countries and continents, and with many different motivations—organizations take a massive hit to their brand and reputation. The public quickly loses trust in businesses whose poor cyber hygiene compromised their personal data. Stock prices fall and customers take their business elsewhere. But if that’s not enough, there are also job losses, regulatory fines, and significant mitigation costs that frequently result from breaches

Stopping Breaches

So how do you defend against these kinds of attacks? Two important ways to combat breaches are by 1) performing regular security tests and 2) effectively applying comprehensive patching. In other words, testing your own defenses before the criminals do (and fixing any holes) is the best defense.

In a recent survey commissioned by Synack, 97% of respondents said security testing was either extremely or very important. That said, according to a recent TAG Cyber study, less than half were happy with their current pentesting vendor. Many complained of challenges with scheduling, poor quality of results, inadequate reports that are hard to follow, and too much burden on their security teams.

Hopefully you’re convinced that security testing is worth doing. But how do you find the right test, when so many companies are pitching their products and tossing around so much jargon?