August 2026 edition of BlueOrange Connections

Hi friend,

Thinking Like an Attacker: A Pen Tester’s Perspective on Why Penetration Testing Matters

I came across a number the other day that would keep most IT professionals up at night: 43,200. 

This is the number of ransomware attacks predicted to occur each day by 2031, based on rising industry trends. That’s an attack every 2 seconds (Cybersecurity Ventures, 2025). 

I’ll share another shocking number: 74. That’s the percentage of critical vulnerabilities that were not fully remediated by organizations in 2025 (2026 Verizon Data Breach Investigation Report). 

If that’s not enough to make you lose sleep, IBM Newsroom reported the average cost of a data breach was $4.99 million in 2025, and it’s only expected to rise.

Find Out Before They Do
The good news is that professional penetration testers can help identify your environment’s critical weaknesses by approaching it the way a real threat actor would. That perspective gives your organization a realistic view of your security posture. 

By identifying vulnerabilities, performing enumeration, and exploiting weaknesses through chained attacks designed to achieve privilege escalation and compromise, penetration testers show how an attacker could pivot through an environment, move laterally, and ultimately gain access to your critical systems and data.

Professional penetration testers also prioritize findings, explain business impact, and recommend remediation steps with validation testing to confirm the fixes worked. The result is a clearer understanding of your organization’s risks, gaps, and opportunities for improvement before a threat actor can discover them. That’s a much better way to get a good night’s sleep.

The Times They Are A-Changin’
Bob Dylan got it right when he sang, “The Times They Are A-Changin’.” That statement is more relevant than ever in today’s constantly evolving cybersecurity landscape. Two major developments are making a big impact across the industry: cyber insurance requirements and proposed HIPAA regulatory changes.

Over the past several years, cyber insurance underwriters have continued tightening their requirements. Controls such as multifactor authentication, EDR deployment, and documented incident response plans have become standard expectations for organizations seeking coverage. Alongside these, annual, sometimes more frequent, penetration testing requirements are showing up in policy renewals, which may force the conversation about whether your organization is ready or not.

An even bigger shift in the industry may be coming with the proposed changes to HIPAA regulations. Among these is a proposed requirement for covered entities to conduct penetration testing at least once every 12 months. If your organization doesn’t already have a regular penetration testing cadence, you may be required to establish one.

The Case for Penetration Testing
Whether the motivation comes from industry trends, insurance requirements, regulatory changes, or your organization’s own risk appetite, the direction is clear: penetration testing is shifting from a recommended practice to a business necessity. Organizations that establish a recurring penetration testing program today gain evidence-based insights that support future security decisions, strengthen their overall security posture, and reduce organizational risk. The question is no longer whether penetration testing provides value. The question is whether your organization can afford to go without it.

Katherine Ramage
Offensive Security Supervisor, BlueOrange Compliance