{"id":46041,"date":"2022-04-05T07:15:14","date_gmt":"2022-04-05T07:15:14","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/testing-testing-testing-why-red-teaming-is-a-must-for-every-ciso\/"},"modified":"2022-04-05T07:15:14","modified_gmt":"2022-04-05T07:15:14","slug":"testing-testing-testing-why-red-teaming-is-a-must-for-every-ciso","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/testing-testing-testing-why-red-teaming-is-a-must-for-every-ciso\/","title":{"rendered":"Testing, testing, testing: Why Red Teaming is a must for every CISO"},"content":{"rendered":"

Advertorial<\/span> Security must be tried, tested, and tested again. It\u2019s become easier than ever for cybercriminals to find stealthy new ways to gain access to and navigate laterally across systems, exploit gaps in hybrid workflows, or hijack cloud accounts to gain access to a target. It is vital that every CISO can offer a clear picture of how their security is really holding up against the latest tactics, techniques, and procedures.<\/p>\n

However, all too often I\u2019ve seen my fellow CISOs fall into a cycle of preparing annual penetration tests of point systems to be \u201ccompliant,\u201d which in fact only makes them sitting ducks just waiting for a breach to occur.<\/p>\n

Vulnerability scanning simply does not suffice<\/span>
\n<\/h3>\n

The truth is, many CISOs simply fail to go far enough by opting only for a basic penetration test. This involves a short technical test of a specific component or system, the goal being to find and exploit technical vulnerabilities.<\/p>\n

Often, however, it\u2019s little more than an automated scan, demonstrating outstanding vulnerabilities but without any context concerning the actual threats facing your business \u2013 or how attackers could exploit them.<\/p>\n