Continuous Penetration Testing: Keeping Security Testing Close to Change

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.

Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.

Wiz earned Leader status in Forrester's Q3 2026 Proactive Security Platforms Wave, scoring 5.0/5.0 on 8 of 21 criteria, including cloud visibility, exposure validation, and remediation augmentation.

CVSS, EPSS and KEV are all built around published CVEs, so they cannot score findings in your own application code. This practical guide shows how to rank exploitable issues like tenant boundary flaws in a continuous testing queue.

Drawing on Gartner's Innovation Insight on PTaaS, this piece argues continuous pentesting beats point-in-time engagements, with remediation cycles twice as fast for adopters by 2028.