Thank You for Your Interest in the CISO’s Guide to Justifying Offensive Security Investments

One of the core components of a CISO’s role is to mitigate and manage risk at the highest level. While strong defensive security is necessary, it is no longer sufficient. It’s like providing an army with weapons, but not additional intelligence on the enemy or on weaknesses in national defense. 

Penetration testing demonstrates potential attack paths, while red teaming shows your team where an advanced adversary can outmaneuver controls and defenses. 

The insights gained from these tests can:

• Reduce mean time to detection (MTTD) and response (MTTR)
• Accelerate time-to-remediation for high-risk weaknesses
• Improve cyber insurance posture
• Streamline and maintain compliance efforts

Cybersecurity is increasingly seen as a core competitive. As Forbes notes, “Investors and stakeholders increasingly recognize the importance of security, making it a fundamental consideration in their decision-making processes.” 

Strong defensive and offensive security postures demonstrate to investors and markets that you are committed to long-term success, understand the relevance of cybersecurity modern business, and maintain a culture that goes beyond the “bare minimum” to truly protect key assets.

As offensive security techniques continue to prove their value against modern attacks, they are increasingly included in data privacy and security standards. Key compliance frameworks now explicitly require or strongly encourage offensive security measures: 

• PCI DSS: Organizations handling payment card data must perform penetration tests at least annually, or after making any significant changes to the environment.
• GDPR: Article 32 requires data controllers and processors to regularly evaluate the effectiveness of their security measures, which penetration testing and red teaming directly facilitate.
• HIPAA: HIPAA requires covered entities to conduct security risk analyses regularly, and the Security Rule’s Evaluation Standard highlights the need for periodical technical evaluations. In December 2024, the US Department of Health and Human Services proposed updating the Rule to explicitly mandate annual pen testing and biannual vulnerability scanning.
• SOC2: Auditors highly recommend penetration testing to satisfy specific Trust Services Criteria (TSC) to monitor activities and identify security weaknesses.
• ISO/IEC 27001: Annex A emphasizes the need to not only find and mitigate vulnerabilities, but test security functionality – something facilitated by vulnerability management, pen testing, and red teaming.
• NIST CSF: The “Identify” pillar of the NIST Cybersecurity Framework (CSF) states that organizations need to understand and discover weaknesses within their systems and controls. Offensive security techniques naturally lend themselves to this step

As Fortra’s Mieng Lim, VP of Product Management, states, “[H]ow can you know where you’re going without a roadmap? Your whole security setup is ostensibly to protect your internal assets from outside attackers. Great. Do you know where they’re going to attack? If you had an accurate inventory of all your weak spots, you’d have a pretty good guess.”

A vulnerability scan will put any penetration test ahead of the game. Instead of having to find vulnerabilities from scratch, the results of the scan will tell pen testers where to look, what to test, and what to exploit. As Lim sums up, “VM can tell you how many vulns you have and where they reside, while pen testing identifies which of those CVEs presents the greatest potential for compromise.”

After applying patches to the most important vulnerabilities (the right VM program will automatically prioritize these for you based on severity), it’s time to see what else a motivated attacker can do. While pen testing operates within a defined scope and checks regulatory boxes, red teaming tests your organization’s entire defensive capabilities, assessing deficiencies in not only controls but in overall response (from alerts to SOC actions) and provides an outbrief of what could have (and should have) been caught so security teams know exactly where attackers can get in.

Fortra’s Core Impact provides pen testing software and works with Cobalt Strike and Outflank Security Tooling (OST), de facto standards for red teaming tools. Using these tools together enables teams to perform advanced red team engagements with relative ease.

Purple teaming means that both offensive and defensive security groups share information with the intent to inform the company of overall weaknesses – rather than on “winning” and keeping “trade secrets” to themselves. This is one of the investments (be it in-house or paired with an MSSP) that will help organizations see the greatest ROI from their red team technology investment.