Pentest vs EASM: how effective are they at detecting cyber vulnerabilities?
Faced with growing cyber risks, CISOs are looking to improve the detection of threats to their information systems. Analysis of the [external attack surface (EASM)](https://www.boardofcyber.io/ressources/blog/gestion%20des% 20vuln%C3%A9rabilit%C3%A9s%20et%20surveillance%20des%20menaces/external-attack-surface-management-evaluer-prioriser-remedier) and implementing pentests make it possible to detect flaws, test vulnerabilities and measure their impact and severity. The aim is to encourage teams to gain a better understanding of the applications they use.
Pentests and EASM are often two complementary approaches, even though each has its own scope of application.
The former provides a snapshot and in-depth overview of the risks within a defined perimeter at a given moment in time. The latter acts as a continuous monitoring tool to identify assets exposed on the Internet.
To obtain an accurate view of cyber risks, implementing intrusion tests is insufficient without an EASM approach, and vice versa.
Pentest: how does it work?
What is a pentest?
A pentest (penetration test) involves simulating a real attack on an organisation's information system. Its objective is to identify and exploit vulnerabilities and measure the impact of an attack on the entire production chain.
There are different types of penetration tests:
- web application testing,
- network testing (NAC),
- Wi-Fi security testing
- social engineering testing,
- IoT testing.
By definition, a penetration test is limited to a specific scope and time frame.
The intrusion test process
A pentest is carried out in several stages.
- Definition of the scope: the organisation chooses the systems, applications or environments to be tested.
- Information gathering: identification of targets, passive or active reconnaissance, determination of black box, grey box or white box intrusion test models, etc.
- Detection and exploitation of vulnerabilities: identification of known or probable flaws, simulation of attack scenarios to verify the impact, etc.
- Report and recommendations: analysis of results with identification of vulnerabilities to prioritise corrective actions according to the level of vulnerability.
When and in what circumstances should a pentest be carried out?
Penetration tests are useful in three main cases.
- Regularly testing digital security: a pentest allows you to ‘put the information system to the test’ and assess its resistance to cyberattacks. It is an excellent way to obtain an accurate view of cyber risks at a given moment in time.
- To understand your level of exposure to attacks: through penetration testing, CISOs improve their understanding of the level of security in a specific high-stakes area and thus strengthen their remediation plan.
In summary, penetration testing is a one-off, targeted tool that is useful for demonstrating the level of security at a given moment in time. Although highly effective, its scope of application is limited. Given the constant evolution of the external attack surface, pentesting is necessary but insufficient. While it can be used to determine the level of security, it must be part of a more comprehensive cyber strategy. An asset that is exposed but unknown to the CISO can never be tested, which is why it is important to supplement the toolkit with EASM.
Finally, penetration testing highlights a reality at a given moment in time, which may no longer be valid in a week's time in the event of changes or external intrusions.
Pentest vs EASM: where to start?
What is EASM?
[*External Attack Surface Management (EASM)] (https://www.boardofcyber.io/ressources/blog/gestion%20des%20vuln%C3%A9rabilit%C3%A9s%20et%20surveillance%20des%20menaces/external-attack-surface-management-evaluer-prioriser-remedier) *involves identifying, assessing and prioritising fixes for vulnerabilities related to digital assets exposed on the internet. In concrete terms, this means identifying web resources – domains, subdomains, IP addresses, APIs, cloud environments, third-party services – and estimating their level of cyber risk.
It is not just an inventory. It also assesses the criticality of the digital asset based on its vulnerability and its impact on the business. This approach reveals areas of exposure that are often invisible, such as shadow IT or forgotten or poorly configured services.
Pentest or EASM, which to start with?
Pentests only make sense within a scope where the company has a real stake (e-commerce site, public administration site, etc.) or where there is doubt. This is why EASM is the starting point.
- Step 1: map and assess your external attack surface.
Detecting vulnerabilities in your cyber exposure surface allows you to target remediation actions. EASM provides a continuous, up-to-date view of assets at risk. The aim is to prioritise penetration testing according to the level of vulnerability of the resource.
- Step 2: Test appropriately.
The effectiveness of a pentest depends on the scope it covers and the depth of the research. And because it can be costly, intrusion tests should be carried out as a priority on the web and application services that are most at risk or those with the most significant business implications.
In other words, EASM structures risk knowledge while ****pentesting measures it. In practice, EASM is the first step in continuously analysing threat exposure (CTEM) and guiding action priorities.
What are the limitations of pentests?
- One-off view: a pentest measures cyber risk at a given moment in time. However, the external attack surface is constantly changing. Vulnerabilities may appear between two test campaigns.
- Defined scope: penetration testing is carried out according to a predefined scope. Assets excluded from the scope are not analysed, leaving ‘blind spots’ in the cybersecurity risk map.
- Costs and resources: a pentest campaign is costly and requires the mobilisation of numerous human resources (CISO, CIO, compliance, etc.).
- Partial unavailability: despite the teams' caution, pentesting poses availability risks if carried out in a production environment.
Penetration testing remains an effective tool, but it is far from sufficient for controlling an organisation's cyber risk. As part of a proactive approach, cyber performance rating solutions (https://www.boardofcyber.io/cas-dusage/evaluer-sa-performance-cyber) offer a comprehensive and continuous overview of problems and areas for improvement.
Cyber risk rating solutions: complementing penetration testing
Cyber rating: what does it involve?
Given the limitations of penetration testing, cyber performance rating solutions provide a pragmatic and continuous response. They analyse public data and collect data from cyber surveillance infrastructures (open ports, expired certificates, etc.). They produce a score that assesses overall cybersecurity performance. This score evolves as risks are discovered and corrections are made. It can also incorporate [third-party cyber risks (TPCRM)] (https://www.boardofcyber.io/ressources/blog/conformite-et-reglementation-en-cybersecurite/gestion-des-risques-cyber-des-fournisseurs-les-esn-face-au-double-defi-de-la-conformite-et-de-la-performance).
Cyber rating solutions such as Security Rating® offer real-time monitoring of cyber risks.
Why choose cyber rating over pentesting?
- Fast, non-intrusive analysis
An initial assessment is available in less than 20 minutes. Unlike pentesting, there is no impact on production and no intrusion into systems.
- Visibility across all assets
Domains, subdomains, email, TLS/SSL configuration, DNS, cloud exposure: cyber rating covers the entire external exposure surface, ideal for an EASM approach. Beyond detection, these cyber rating solutions facilitate the development of a clear remediation plan. Dashboards report vulnerabilities by criticality and prioritise corrective actions. Detailed reports enable reporting to technical teams as well as management.
- An approach extended to third parties and subsidiaries
Cyber rating does not stop at the main organisation or parent company. It covers risks related to business units, subsidiaries and local agencies, as well as those related to suppliers and partners. Overall, cyber rating solutions strengthen cybersecurity risk mapping as part of Third-Party Risk Management (TPRM). (https://www.boardofcyber.io/ressources/blog/gestion-des-fournisseurs-et-des-risques-tiers-tprm-tpcrm/tprm-comment-aborder-un-projet-de-third-party-risks-management)
- Continuous monitoring
Unlike penetration testing, automated analysis of an organisation's assets allows for continuous risk monitoring and effective detection of vulnerabilities, poor DNS/TLS hygiene, lack of DMARC/SPF, or known vulnerabilities. Continuous monitoring promotes understanding of risk sources and encourages a proactive cybersecurity culture.
- A less expensive method
The cost of a penetration test varies greatly depending on the size of the perimeter and the complexity of the systems (between £2,500 and £13,000). In contrast, a cyber rating solution is based on automated and continuous analysis, which is much more affordable (around £1,800 per year).
Cyber risk rating is an effective solution for improving knowledge of attack surfaces. It guides priorities and allows pentests to be focused on highly critical resources.
Board of Cyber, solutions for assessing your cyber performance
Board of Cyber has designed Security Rating®, a solution designed to assess, manage and improve the cyber performance of organisations.
Based on an automated, non-intrusive analysis of exposed assets, Security Rating® maps vulnerabilities without impacting production. The solution is based on:
- an analysis of the organisation's public resources,
- a competitive benchmark to assess the organisation's cyber performance relative to its sector.
Each organisation receives an overall rating from 0 to 1000, as well as an assessment ranging from A to E in six key areas.
- Asset identification
- Access security
- Data security
- Network security
- Application security
- Operational security
The dashboards allow organisations to compare themselves to their industry and communicate clear indicators to senior management. Detailed reports enable technical and operational teams to define a clear and relevant remediation plan to improve and strengthen the company's cybersecurity posture. These dashboards facilitate the reporting of information to senior management and can facilitate the approval of budget commitments.
By combining continuous scoring and contextual analysis, Board of Cyber provides an initial assessment of the cyber performance of companies and government agencies. Thanks to our continuous approach, CISOs can also supplement the analysis already carried out via pentests. This gives them a better understanding of their risks and enables them to adopt a strategic approach to managing exposure to threats (CTEM).
