The Fallacy of Pen Testing as a Priority in Cybersecurity
If you’ve been following our STOP the #CYBERinsanity series, you already know this uncomfortable truth: Most cybersecurity failures aren’t caused by brilliant hackers or exotic zero-day exploits. They’re caused by bad habits, poor sequencing, and leadership decisions driven by urgency instead of clarity.
One of the most common (and costly) mistakes we see when organizations begin to “take cybersecurity seriously” is this:
They rush straight to penetration testing.
The logic sounds reasonable: “Let’s test our security and see if we’re vulnerable.”
But that question—asked too early—almost always leads to wasted dollars, predictable outcomes, and delayed risk reduction, rather than meaningful improvement.
Pen Testing (as a priority) is #CYBERinsanity.
Not because penetration testing is bad—but because doing it out of order is.
START HERE:
Assess Risk & Exposure
Remediate - People, Process...
Validate - Pen Testing, Audit...
Cybersecurity Has an Order of Operations
The visual above captures simple but often ignored realities – validated by every maturity security program and framework:
ASSESS (first) > REMEDIATE (second) > VALIDATE (after the first two!)
1) ASSESS - Quantified Risk & Exposure
- Known vulnerabilities and exposures
- Missing or ineffective controls
- Misconfigurations across systems and identities
- How technical gaps translate into business risk
Running a pen test without first quantifying risk is like stress-testing a building without reviewing the blueprints.
1) REMEDIATE - People, Process, Technology, Controls
Remediation is where organizations:
- Fix misconfigurations
- Patch vulnerabilities
- Strengthen identity and access controls
- Improve people, process, and technology alignment
This is where actual risk mitigation happens.
Here’s the part many vendors won’t say out loud:
If remediation hasn’t occurred, penetration testing will almost always succeed in predictable ways.
Paying to rediscover already-documented weaknesses isn’t security—it’s expensive confirmation.
3) VALIDATE — Pen Testing, Audit, Certification
- Confirms control effectiveness
- Identifies residual or unknown risk
- Supports audit, certification, and compliance needs
Used too early, it delivers noise—not insight.
Validation without remediation wastes dollars — and delays meaningful risk mitigation.
The Most Common (and Costly) Shortcut
Organizations assess, then jump straight to validate, skipping remediation altogether.
This shortcut is common—but costly.
It creates:
- Long reports with obvious findings
- Executive anxiety without a roadmap
- IT fatigue and frustration
- Spend without measurable improvement
Not because testing is flawed—but because the sequence is.
This Isn’t Opinion – It’s Industry Best Practice
For those wondering whether this approach conflicts with industry standards, it doesn’t. Frameworks such as NIST consistently position penetration testing as a validation activity, intended to:
- Verify the effectiveness of implemented controls
- Confirm security posture after remediation
- Identify residual risk—not foundational gaps
In other words, penetration testing is designed to answer: “Do our defenses work?” —not: “What defenses are we missing?” That distinction matters.
Pen Testing Isn’t the Problem — Doing It Too Soon Is
The greatest risk isn’t failing a penetration test. It’s believing you’re making progress while skipping the steps that actually reduce exposure. #CYBERsane organizations:
- Assess risk honestly
- Remediate deliberately
- Validate intentionally
If the question being asked is, “When can we get a pen test?” The better question is:
What are we trying to validate—and what have we already fixed?”
Answer that honestly, and the right next step becomes obvious.
Ready to STOP the #CYBERInsanity?
If penetration testing is on your radar, let’s first make sure it’s being used for validation -not discovery.
We’ll help you determine:
- Whether you’re ready
- What type of testing actually makes sense
- How to avoid spending money on predictable outcomes
That’s how you stop the insanity—and build security that actually holds.
About the Author:
Matt Tankersley, CISSP is a US Navy combat veteran and the Founder & CEO of TechOnPurpose. Matt is recognized as an innovator with over 35 years of experience in Information Technology specifically in the areas of collaboration, cloud, security, and managed services. Recognizing the complexity, risk and blindsides that business owners face led Matt to create the TOPCYBER21™ Framework, which simplifies how organizations operationalize cybersecurity. Matt’s dedication to customer experience and unwavering belief that “Technology is at the Heart of Business today,” cast the foundation for our culture and simple operating philosophy: “We love what we do, who we do it with, and who we do it for.”
About TechOnPurpose:
Based in Austin, Texas, TechOnPurpose (“TOP”) delivers comprehensive managed IT and cybersecurity solutions to select clients globally. TOP’s approach to managed IT and cybersecurity continues to deliver simplified conversations and comprehensive, affordable solutions for our global customer family of Small & Medium Businesses and Non-Profits.
