A city wants to treat continuous vulnerability scanning as continuous penetration testing and cancel periodic adversarial assessments. What should the tester advise?
Select an answer to reveal the explanation.
Short Explanation
Daily tooth-brushing is not the same as a dental exam with X-rays. Keep the scanners humming for hygiene, and still schedule real pentests that try to break in under the rules.
Full Explanation
If a city wants to treat continuous vulnerability scanning as continuous penetration testing and cancel periodic adversarial assessments, advise separating ongoing VA hygiene from periodic penetration tests; they fill different roles. Continuous scanning does not fully replace adversarial simulation of chained attacks and business impact. Replacing both with annual policy reviews leaves technical risk untested. Running scanners only on the night of a pentest does not make the labels equivalent. Exam caveat: procurement should fund both continuous discovery and scheduled pentests with exploitation where authorized. Operational check: keep scanning cadences for drift detection, schedule periodic CPTS-style assessments against critical civic systems, and clarify deliverables so leadership does not equate dashboards with adversarial validation. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.