Penetration testing must review threats and vulnerabilities experienced in the last 12 months.

Penetration testing must review threats and vulnerabilities experienced in the last 12 months.

• A. Not Required
• B. Last Quarter
• C. Last 5 Years
• D. Last 12 Months

Answer: (D)

Penetration testing needs to reflect the current threat landscape and the vulnerabilities that could realistically affect the environment. Reviewing threats and vulnerabilities experienced in the last 12 months keeps the test aligned with recent attacker techniques, newly disclosed CVEs, and changes in the environment, so the scenarios and exploited weaknesses are relevant to today’s risk level. Choosing a window like last quarter would miss many recent developments, while a window of several years includes outdated issues that may no longer be actionable or present. A window of the last 12 months strikes the right balance, ensuring the test evaluates controls against recent and realistic risks.

Penetration testing needs to reflect the current threat landscape and the vulnerabilities that could realistically affect the environment. Reviewing threats and vulnerabilities experienced in the last 12 months keeps the test aligned with recent attacker techniques, newly disclosed CVEs, and changes in the environment, so the scenarios and exploited weaknesses are relevant to today’s risk level. Choosing a window like last quarter would miss many recent developments, while a window of several years includes outdated issues that may no longer be actionable or present. A window of the last 12 months strikes the right balance, ensuring the test evaluates controls against recent and realistic risks.