Brian Soldato: Organizations still in the dark about aspects of their risk posture. Conducting a few pen tests a year is not enough, he says. “A lot of organizations don’t understand their entire risk in relation to the threats that are out there today,” Soldato says. He also discusses the value of ongoing validation of security products and controls in an environment; why an occasional pen test is insufficient; how to quantify risks for key stakeholders; why not an occasional test is enough.”]
Source: https://www.careersinfosecurity.com/finding-those-security-gaps-a-10231