Few leadership teams would be comfortable relying on financial accounts that had never been examined by anyone outside the finance team. Yet a great many businesses place their confidence in security controls that have never been independently tested, assuming that a control which has been installed must be working as intended.
The UK government’s Cyber Security Breaches Survey 2025/2026, released in April 2026, shows how widespread that assumption is. In the 12 months covered by the survey, only 18% of businesses had carried out a cybersecurity vulnerability audit and 13% had carried out penetration testing, while 30% had completed a risk assessment covering cybersecurity risks.
Guerassim Nikolov reads those figures as a gap in assurance rather than simply a gap in technology. “Businesses have spent heavily on firewalls, monitoring and protective software, yet only a minority have checked whether those measures would stop a determined attacker,” he says. “A control that has never been tested is one the business is taking on trust, and assurance requires evidence.”
Key Takeaways
- Many businesses assume their security controls work without independent testing, a risky reliance according to the Cyber Security Breaches Survey 2025/2026.
- Routine assessments should prioritize identifying and fixing weaknesses, guided by principles from the National Cyber Security Centre (NCSC).
- Penetration testing provides assurance about an IT system’s security, akin to a financial audit, and should involve third-party specialists for an unbiased perspective.
- Realistic test scenarios enhance the relevance of penetration tests, targeting high-risk areas between evaluations.
- Organizations must act on penetration test findings to improve processes, moving from assumption to evidence-based security measures.
Table of contents
Routine assessment comes first
Testing begins with the everyday work of finding and fixing weaknesses. The National Cyber Security Centre’s (NCSC) vulnerability management guidance sets out a series of principles: apply updates promptly and ideally automatically, understand what systems and software exist across the estate and who is responsible for them, and triage and prioritize vulnerabilities where updating does not resolve the problem or no update is yet available.
The guidance also places ownership at senior level: where there are legitimate reasons not to apply an update, the decision not to do so is a senior-level risk decision. It adds that the process should always be evolving to keep pace with changes in the estate, new threats and new vulnerabilities.
What penetration testing is for
Penetration testing sits on top of that routine. The NCSC defines it as a method for gaining assurance in the security of an IT system by attempting to breach some or all of its security, using the same tools and techniques an adversary might.
The NCSC says a penetration test should be thought of as similar to a financial audit: the finance team tracks expenditure and income day to day, and an audit by an external group ensures that the internal team’s processes are sufficient. Likewise, penetration testing is best seen as a method for gaining assurance in an organisation’s vulnerability assessment and management processes, not as a primary method for identifying vulnerabilities. A planned penetration test, the NCSC adds, does not mean normal security testing should stop.
That framing explains why independence matters. The NCSC advises that third-party penetration tests should be performed only by qualified and experienced staff. Engaging a specialist testing provider brings an outside perspective and attacker-style expertise to sit alongside in-house capability, much as external auditors work alongside a finance department.
“The value of an independent test lies in what it reveals about the organisation’s internal processes,” Guerassim Nikolov says. “If the testers find something the internal team already knew about, that is reassuring. If they find something nobody had seen, the real question is why the existing checks missed it.”
Scoping a test that reflects reality
A test is only as useful as the scenarios it examines. The NCSC recommends considering, based on previous incidents, which scenarios are most relevant to the organisation. Scoping around realistic threats produces findings that relate directly to the risks leadership is trying to manage.
The NCSC also acknowledges that it is not uncommon for a year or more to pass between penetration tests, so each test should target the areas of greatest concern.
Turning findings into improvement
The report is where a test earns its value. According to the NCSC, previously unknown vulnerabilities found by testers should be given special attention, with the aim of working out how such issues could be spotted in future. It adds that while highly experienced testers may find subtle issues that internal processes have not picked up, this should be the exception rather than the rule.
The NCSC also reminds organisations that testers’ proposed solutions may not be the only ones possible, and that risk assessment and decisions on fixes rest with the organisation.
“A penetration test report should change how the organization works as well as what it patches,” Guerassim Nikolov adds. “When each finding is traced back to the process that should have caught it, the next test has less to discover, and that is the clearest sign the security programme is maturing.”
Read Next
A few related pieces worth your time:
- How Does a Private Cloud Protect Sensitive Company Data?
- Zero Trust Explained: What It Means for Everyday Employees
- Top ZTNA Cybersecurity Solutions Providers for Enterprises in 2026
Evidence over assumption
With fewer than one in five businesses carrying out a vulnerability audit in a year, regular testing remains a point of difference. Organisations that pair routine vulnerability management with periodic independent testing can point to evidence that their defences work, rather than simply a list of what has been bought.
