How to implement a continuous offensive security testing program

How to implement a continuous offensive security testing program The hard part was never finding the exposure. It was deciding what to do about it: whether to patch, mitigate, monitor, or accept, and banking that that decision would still hold tomorrow. A penetration test answers this question for the day it runs, then quietly expires. The environment shifts, a control drifts, a new technique lands, and the report now describes a network that no longer exists. That gap, between finding an exposure and trusting the decision you made about it, is what most security teams are still wrestling with. It’s also the gap a new Gartner study sets out to close. In How to Implement a Continuous Offensive Security Testing Program, Gartner makes the case that calendar-based penetration testing is simply too slow for the speed at which modern environments and threats now move. The study’s answer is to move to a continuous offensive security testing (COST) model: a shift from periodic assessments to continuous, trigger-driven validation built into the workflows your teams already run. Why periodic pentesting quietly stopped working The mechanics of the old model weren’t wrong; they were built for simpler times, and slower adversaries. Scan on a schedule, score by severity, queue the worst (critical severity) for patching, and assume the controls you deployed are working. This model was already threatened by increased speed and compute power. But the accelerant that really broke it is AI. We’ve crossed what’s increasingly called the Mythos threshold, the point at which AI models became capable enough to discover and weaponize vulnerabilities autonomously. In the short time since, the window between a vulnerability going public and an attacker using it has collapsed from weeks to hours. The Zero Day Clock, which tracks that window in real time, averages less than 10 hours for 2026, down from roughly 53 days just two years ago. It shifts as fresh data lands but now sits firmly below 24 hours. And the volume keeps climbing: 49,183 new CVEs were published in 2025 alone, about 135 a day, up roughly 40% year over year, with fewer than 0.5% ever patched. It’s easy to see how your quarterly pentesting results are out of date before they’re even reported. Zero Day Clock on Mean-Time-to-Exploit (Mean TTE) The result is a decision gap every SOC is feeling: exposure piles up faster than teams can clear it; they can see which vulnerabilities exist but not whether the chain would actually succeed in their environment, against their controls; and when attacks land in minutes, no one can prove which call is defensible to an auditor or the board. The three legs of Gartner’s COST framework Gartner frames COST as a cyclical journey (Design, Build, Run, Improve), and three points carry the weight. - First, validation is triggered by change, not the calendar: risk-tiered triggers (a new internet-exposed asset, a zero-day alert, a critical control update, a code commit) each map to an urgency and a completion window, so high-risk change is validated in hours, with routine change on the next cycle. - Second, it runs on a continuous sensing layer: a unified view of exposure, attack-surface, threat intel, and control signals that separates material changes from noise. - Third, no single method covers the entire job, so you orchestrate rather than sprawl: Gartner lays out penetration testing, control validation, red teaming, bug bounty, and adversarial exposure validation (AEV), which combines breach and attack simulation with pentesting, and warns against bolting on standalone tools in favor of coordinating them. It also insists findings directly feed treatment workflows rather than stalling and getting lost in hundred-page PDFs. Gartner’s research puts a date on it: by 2028, more than 60% of enterprise pen-test programs will have moved off the annual cycle entirely, running as continuous validation governed by CTEM and executed within DevSecOps pipelines as the new primary proof of resilience. The part that’s easy to miss: one method simply can’t cover the entire estate Gartner prescribes multiple methods because no single one can answer “is this exploitable here?” everywhere in your environment. Take the most powerful option: autonomous penetration testing. Where it can safely fire a live exploit chain against a reachable asset, it’s the strongest proof there is: an attack actually executed in your environment. But live exploitation is bounded by where it can run: - Business-critical systems you can’t risk - Restricted networks - Air-gapped segments These are all off limits to anything that detonates a real exploit. Many CVEs never get a public or safe exploit to fire; and on the day a CVE drops, there’s a lag before a weaponized exploit becomes online. In a typical enterprise, the safely-testable slice is around 10–15% of the exposure picture. For the other 85–90%, the honest answer isn’t more detonations but control-aware inference. The answer for ground testing is TTP-chain validation Think of a rocket: you prove the ones you can’t afford to launch (one-of-a-kind, crewed, or still on paper) by testing each component on the ground against real conditions. If a required part fails, it doesn’t fly, and you’ve figured this out without the expense and risk of an actual launch. An exploit works the same way: it’s a chain of techniques run in sequence, and like the rocket’s parts, each link can be tested on its own. Decompose a CVE into that chain, then validate each technique against your deployed controls, such as EDR policy, hardening, LSASS protection, allow-listing, and the firewall. TTP chaining explained If your environment breaks any required link, then the exposure isn’t exploitable here, and you have that answer with evidence, on the assets you can’t touch and on threats no one has weaponized yet. The answer? Launch the rockets you safely can; and prove the component parts individually for everything else. Build the loop, not another tool This is where “orchestrate, don’t sprawl” becomes your mantra. Individual tools each answer a fragment of the question: one scans, one simulates, one runs a pentest. Stacking more doesn’t close the decision gap, it just widens the integration burden. What closes it is treating the methods as one loop, validate, decide, fix, re-validate, built on on the following components: - Autonomous penetration testing runs AI agents that chain real-world attacks across your environment to reveal which exposures are genuinely exploitable, what your controls stop, and how to close the gaps. It is all within the guardrails you define. - Exposure validation uses TTP-chaining to prove exploitability without a live exploit, covering business-critical, restricted, and air-gapped assets, as well as brand-new CVEs on day one. - Breach and attack simulation continuously tests your prevention and detection stack against the newest techniques, so every decision stays defensible as controls and assets change, catching control drift before an attacker does. That loop also answers Gartner’s caution against automation alone in favor of tunable autonomy with a chain of custody, where findings land as Jira or ServiceNow tickets with evidence attached. Where Picus fits Picus appears in Gartner COST vendor matrix under adversarial exposure validation (BAS plus pentesting), the architecture the framework points toward: coordinated methods as one engine, not a do-everything suite. The platform runs the whole loop, and it’s signal-driven: every cycle is triggered by a real-world change in threat intel, asset topology, or control effectiveness, not a schedule; in other words, the sensing layer Gartner describes, made operational. Where live exploitation is safe, Picus Autonomous Penetration Testing executes the real chain; where it’s not, Picus Exposure Validation proves exploitability through TTP-chaining, no detonation required; and Picus Breach and Attack Simulation keeps every control and decision defensible over time. It’s open by design, ingesting assets, vulnerabilities, and business context from the scanners you already run. Based on Picus customer data, the outcomes track the very KPIs that Gartner tells programs to measure: - 92% fewer SLA violations on high and critical vulnerabilities, - 89% reduction in MTTR on emerging threats, - 2x control effectiveness within three months, and - Up to a 98% smaller critical-ticket backlog*, all by closing real gaps instead of buying more tools. The question the loop answers The board question has shifted from “are we patched?” to “are we secure right now, and can we prove it?” It’s a question that a periodic pentest can no longer answer, as it stops being pertinent the moment it finishes running. Building COST well takes two moves: make validation continuous, so the answer never goes stale, and cover the whole estate, so untouchable assets aren’t the ones you stop validating. One method answers a slice. The loop answers all of it, turning every exposure into a decision you can defend. To see which attacks would actually succeed in your environment, book your free demo here. *Based on a single Picus customer’s data; results may vary by environment.