The Discrepancy Between the Results of Compliant Penetration Tests and What Really Defines an Organization's True Attack Surface
Organizations are investing large sums of money and resources in obtaining ISO 27001 certifications, SOC 2 attestations and performing yearly penetration tests, yet six months after the fact they hear about a breach involving one of their organizations in the media. This trend is so common, that many incident response professionals have used this as a recurring example when conducting post-breach analysis.