Security teams keep finding critical flaws after scheduled testing ends
Enterprise environments change between scheduled security assessments, leaving organizations with periods where new vulnerabilities can go undetected. Synack’s State of Continuous Security Validation report found that 95% of surveyed organizations identified high- or critical-severity vulnerabilities outside planned testing windows during the past year, with 42% encountering them at least once a month.
How often high/critical vulns are found outside testing windows (past 12 mo.) (Source: Synack)
False sense of coverage
Eighty-three percent of security leaders said their testing cadence keeps up with changes across their environments. Many believe their organizations are adequately covered because some part of the environment is always being tested. Only 15% described their security testing and validation programs as continuous.
Enterprise infrastructure changes through API updates, cloud configuration changes, identity changes, and AI-generated code deployments. A single security assessment can take weeks to complete, leaving portions of the attack surface without recent validation.
Thirty-eight percent of respondents said at least one-quarter of their critical attack surface had gone without independent testing or validation during the previous 90 days.
Human experts validate findings
Security teams use AI-assisted testing and deploy AI-generated code. They rely on human experts to verify that vulnerabilities are real and exploitable before taking action. They use AI for repetitive tasks that can be scaled, like reconnaissance, testing coverage, validating exploitability, reducing false positives, etc.
“Automation can surface more signals, but security teams need evidence, not noise,” said Mark Kuhr, CTO at Synack. “Human researchers bring the creativity and context to chain weaknesses, confirm exploitability and show what an attacker can actually do.”
Continuous security validation gains interest
Continuous penetration testing and continuous security validation were identified as the approaches most likely to replace annual point-in-time testing.
Many organizations have adopted elements of continuous testing. Few identify continuous security validation as their primary approach or describe their security programs as continuous.
Compliance-driven testing schedules, integration challenges, limited trust in automation, false positives, difficulty demonstrating ROI, and undefined ownership across teams were the primary barriers to continuous security validation.
Angela Heindl-Schober, CMO at Synack, said organizations are moving toward continuous validation supported by AI and human expertise because infrastructure changes more frequently than scheduled testing cycles.