A penetration test is not finished when the scanner stops
Assessment execution, evidence processing, finding readiness, triage, remediation and retesting are separate states. Calling all of them complete hides risk.
Topic route
Cybersecurity & Governance
Control design, assurance, risk communication and the operational discipline needed to make governance useful rather than ceremonial.
Start Here connection
Cyber governance route
Control design, assurance and decision-led cyber governance.
Return to Start HereFeatured in this topic
Pieces that define the lane.
Filtering coverage is an assurance problem, not an installation count
A successful software deployment does not prove that filtering is configured, enforcing policy and reporting across every device population that depends on it.
Unknown is a status, not a pass
Missing, stale or failed evidence should reduce confidence visibly. An assurance system becomes dangerous when it converts what it could not observe into a healthy result.
Latest in topic
Recent writing within this route.
Version history is a resilience control with a storage consequence
Version history supports recovery, auditability and protection from unwanted change. It also creates storage, retention and governance consequences that need evidence-led management.
The emergency account nobody wants to need
How emergency administrative access can support recovery without becoming an ordinary route around normal security controls.
Cybersecurity maturity is visible in boring work
Why routine ownership, maintenance, evidence and follow-through reveal more about cybersecurity maturity than impressive tooling alone.
Remediation is where testing becomes management
Why remediation is the point where assurance becomes ownership, prioritisation and closure discipline.
A gap assessment is worthless without owned follow-through
Why a gap assessment only matters when leadership turns findings into owned decisions.
ISO 27001 only matters if it changes how the work is run
Why ISO 27001 only becomes credible when it sharpens ownership, evidence, review and closure in live operational work.
Case studies in this topic