Is Penetration Testing and Vulnerability Assessment becoming a saturated market? Are companies open to outsourcing the services or would they prefer to build an in-house team?


37.6k views3 Upvotes19 Comments

Partner in Software, 1,001 - 5,000 employees
The market had saturated for some time but is now looking a possible growth with more next generation security solutions focused on this space. These solutions are largely more focused towards multi-cloud environments as well as having more sophisticated and intent based integrations with a company's infrastructure. A lot of companies have adopted using managed services for the overall security needs that typically focus on monitoring but is likely to expand in to outsourcing these services. As companies build and embed more software in their organizations, the need to monitor as well as patch vulnerabilities is going to need much greater focus. This can be achieved via a larger outsourced managed services versus trying to acquire, train and retain security talent internally.
3 2 Replies
Co-Founder and Director in Software, 2 - 10 employees

Thank you Yousuf. Could you please elaborate on the "next gen security solutions". Are they part of MSSP's offerings?

1
Partner in Software, 1,001 - 5,000 employees

Yes part of MSSP's offerings and I would consider these to be in larger demand going forward.

2
Chief Security Officer in Software, 10,001+ employees
I've seen both. Totally depends on company size and how often you need this type of service. If you have a continual need it makes sense to build an in house capability. If you have set time periods or gates that you need to hit and can control the scope and cost it makes sense to outsource or do it on demand.
1 1 Reply
Co-Founder and Director in Software, 2 - 10 employees

Thank you!

CTO in Software, 11 - 50 employees
I'll continue to beat the drum of the culture of DevSecOps and attempt to build consensus around the fact that periodic penetration testing and assessments are a legacy, broken model that hasn't improved the state of security. Security testing, inventory, and assessments need to be embedded into the SDLC and Deployment processes.
4
Chief Security Officer in Software, 10,001+ employees
Agree with @MikeD.Kail, but not every company is fully Agile and DevOps.
1
VP of Global IT and Cybersecurity in Manufacturing, 501 - 1,000 employees
Agree with the points raised by everyone, for the organizations which are not fully agile, more waterfall, the outsourcing/managed service approach may work if you have planned, required gates to pass.
2
VP of Global IT and Cybersecurity in Manufacturing, 501 - 1,000 employees
Would anyone be willing or able to share with the group what managed service products/solutions you considered if you were considering an all or partial outsource?

1
CTO in Finance (non-banking), 201 - 500 employees
Re pen testing and vulnerability assessment:
There would always be a need to outsource this part. Not all companies would need it, but if for example, you’re in fintech, then you definitely need a 3rd party to do pen testing against your system. That way, you can claim that a 3rd party has verified and certified your system secure.

However, if you do this without doing continuous testing yourself via your internal team, then the engagement with that vendor would be longer and more expensive.

For example. If you’ve never pen tested your own system and you bring in a vendor, then you would do alot of bug fixing while that vendor’s meter is running (so to speak). But if you’ve already done your part, then it’s all formalities with the vendor.

Re outsourcing in general:
IMHO, I never close my doors to outsourcing. There would always be a time wherein you have a spike (months) of urgent and important work to be done but you cant seem to justify hiring people for that because it’s just a “spike”. Then I’d outsource - regardless of it’s outsourcing the whole project or via staff augmentation. If you have an agile or lean setup, then staff augmentation may be the way to go (since it’s just like adding people to your existing team temporarily, or adding a totally new scrum team, but practise-wise, they all still follow your standards and procedures. And you still have total control and have total agility). Finding a trusted vendor may be difficult though. You may need to go through a few before finding one that works for you. But once you do, maintain a relationship. Because that would be a mutually fruitful relationship, even if you move to another company.
1 1 Reply
Co-Founder and Director in Software, 2 - 10 employees

Very Interesting. Thank you so much. makes things so much easier.

Former Chief Technology and People Officer in Software, 1,001 - 5,000 employees
Check out Cobalt.io
2 1 Reply
Co-Founder and Director in Software, 2 - 10 employees

Thank You! I Just did. It is exactly what we do as well. Please do check ZinnoX.com

1
Senior Security and Compliance Auditor in Software, 1,001 - 5,000 employees
As mentioned previously, I also do 3rd party scasn (Daily Vul - Annual Pen) in Prod and SDLC for validation that I'm not making the results look wonderful. I also perform adhoc scans internally a few times per year to further supplement the 3rd party scans. I change up 3rd party vendors every few years. This has provided me with better results as not all scans are equal as well as keeps me fresh on whats out there.
1 3 Replies
Co-Founder and Director in Software, 2 - 10 employees

Thank You Douglas, that sounds like a great strategy. May I ask what specifically you look for in vendors, when you decide to outsource?

1
Senior Security and Compliance Auditor in Software, 1,001 - 5,000 employees

Here’s my general priority list. However, a failure in any of these probably negates a great score in the other categories.
1. Quality – Reliability of results and updated to latest threats
2. Price – This can be higher or lower in priority depending on appetite of the organization
3. Reputation – Sometimes larger customers require that I use a vendor from a list of vendors they’ve approved beforehand.
4. Admin - Ease of use for adding users, adding locations, or navigating the interface.
5. Reporting Features – Readability of reports and limited noise

2
Co-Founder and Director in Software, 2 - 10 employees

This is brilliant! Thank you so much Douglas! It makes me so happy to know that we qualify and excel in each of the points in your checklist (except point number 3, Reputation. Being a Start-Up company, we are yet to gain some recognition in the global market. But we'll get there soon :) ) This has helped us immensely. Thank you.

2
Assistant Director IT Auditor in Education, 10,001+ employees
A combination of both is a good approach. Sometimes outside expertise sees things differently.
2 1 Reply
Co-Founder and Director in Software, 2 - 10 employees

Definitely! Different perspectives help cover a wider range of vulnerabilities.

Content you might like

CTO in Software, 201 - 500 employees
Without a doubt - Technical Debt! It's a ball and chain that creates an ever increasing drag on any organization, stifles innovation, and prevents transformation.
Read More Comments
40.8k views131 Upvotes319 Comments

Patch management: to reduce attack surface and avoid system misconfigurations39%

Malware and ransomware prevention: to protect endpoints from social engineering attacks58%

Malware and fileless malware detection and response: to protect against malicious software49%

Threat Hunting: to detect unknown threats that are acting or dormant in your environment and have bypassed the security controls33%

Not planning to change endpoint security strategy10%


184 PARTICIPANTS

385 views