Security Magazine logo
search
cart
facebook twitter linkedin youtube
  • Sign In
  • Create Account
  • Sign Out
  • My Account
Security Magazine logo
  • NEWS
    • Security Newswire
    • Technologies & Solutions
  • MANAGEMENT
    • Leadership Management
    • Enterprise Services
    • Security Education & Training
    • Logical Security
    • Security & Business Resilience
    • Profiles in Excellence
  • PHYSICAL
    • Access Management
    • Fire & Life Safety
    • Identity Management
    • Physical Security
    • Video Surveillance
    • Case Studies (Physical)
  • CYBER
    • Cybersecurity News
    • More
  • BLOG
  • COLUMNS
    • Cyber Tactics
    • Leadership & Management
    • Security Talk
    • Career Intelligence
    • Leader to Leader
    • Cybersecurity Education & Training
  • EXCLUSIVES
    • Annual Guarding Report
    • Most Influential People in Security
    • The Security Benchmark Report
    • Top Guard and Security Officer Companies
    • Top Cybersecurity Leaders
    • Women in Security
  • SECTORS
    • Arenas / Stadiums / Leagues / Entertainment
    • Banking/Finance/Insurance
    • Construction, Real Estate, Property Management
    • Education: K-12
    • Education: University
    • Government: Federal, State and Local
    • Hospitality & Casinos
    • Hospitals & Medical Centers
    • Infrastructure:Electric,Gas & Water
    • Ports: Sea, Land, & Air
    • Retail/Restaurants/Convenience
    • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
    • Industry Events
    • Webinars
    • Solutions by Sector
    • Security 500 Conference
  • MEDIA
    • Videos
      • Cybersecurity & Geopolitical Discussion
      • Ask Me Anything (AMA) Series
    • Podcasts
    • Polls
    • Photo Galleries
  • MORE
    • Call for Entries
    • Classifieds & Job Listings
    • Continuing Education
    • Newsletter
    • Sponsor Insights
    • Store
    • White Papers
  • EMAG
    • eMagazine
    • This Month's Content
    • Advertise
  • SIGN UP!
CybersecurityManagementLogical SecuritySecurity & Business Resilience

The one-two punch of compliance auditing and penetration testing

By Ray Overby
computer in dark room with green screen

Image via Unsplash

July 5, 2023

For companies worried about the possibility of a cyberattack, the question is not if, but when. Eighty-eight percent of companies worldwide have experienced at least one cyberattack in the past two years. This elevated rate comes even as median IT budgets have tripled since 2018.

Why the discrepancy? Part of the explanation may lie in many organizations failing to capitalize on two important security practices: compliance audits and penetration testing. To reap the benefits of these practices, an organization needs to understand their similarities, differences and the role each plays in security configuration. 

The three phases of a top-to-bottom security assessment

Most security professionals have some level of experience with compliance auditing and penetration testing. But it’s sometimes challenging to determine where they fit in a top-to-bottom security assessment, which has various moving parts to account for. To summarize, a thorough security assessment has three main phases to consider:

Phase 1: Compliance auditing 

Compliance auditing is crucial during the first phase — security leaders must conduct both a configuration-based audit and an operations audit. In a configuration-based audit, IT teams work to ensure their various systems, networks and parameter settings are properly configured and adhere to relevant industry regulations. Reviewing security controls, user access permissions and network configurations is essential before moving ahead with any further testing.

An operations audit consists of a vulnerability scan of all operations systems, which include the integrity layer and larger applications like ERPs and CRMs. This step helps security leaders identify potential vulnerabilities in the mainframe that they should target in a penetration test. 

Phase 2: Penetration testing 

After mitigating any vulnerabilities that appeared during the audit process, IT teams should move on to the penetration test. In a pen test, ethical hackers attempt to bypass an organization’s security measures to identify any vulnerabilities the previous round of audits didn’t catch. 

The ethical hacker, who can be a member of an internal IT team or a third-party, works to gain escalating levels of access to internal systems and attempts to modify them. Afterward, the hacker reports on their findings and recommends next steps. These tests are valuable for both identifying gaps in security architecture as well as testing the responsiveness to security threats. 

Phase 3: Continuous monitoring and evaluation 

A single assessment isn’t enough to ensure 100% compliance and security. With cybersecurity threats always evolving, IT teams must continuously monitor and test their security precautions to identify new vulnerabilities. Conducting both compliance audits and pen tests at least once a year can ensure that security posture remains strong.

Getting the most out of pen tests and compliance auditing

While it’s valuable to understand how compliance auditing and pen testing fit into a security assessment, there are several different ways to execute them. For example, an organization can either conduct a pen test internally or outsource it to a third-party provider. 

Both methods are effective, but in different ways. Nearly half of all cyberattacks are executed by internal attackers, so recruiting a member of an IT team to hack into systems can help protect against this situation. External hacks are just as common, so simulating these attacks are also valuable for identifying vulnerabilities. These pen tests can take significant time and resources to organize, so consider contracting a third-party for assistance. 

Organizations shouldn’t skimp on their compliance audits either, since a single compliance violation can cost an organization millions of dollars. These violations are often revealed during third-party audits, which is why an organization’s compliance team should also perform internal audits to ensure compliance ahead of time. This means keeping tabs of updates to regulations that are relevant to the industry and establishing clear documentation guidelines for compliance policies. 

Don’t overlook the value of comprehensive testing

By leveraging the power of compliance audits and penetration testing, an organization can strengthen its security posture and better protect itself against cyber threats. Comprehensive preparation and monitoring can help safeguard sensitive data and valuable assets while ensuring they don’t have to pay for a compliance violation. 

KEYWORDS: pen test penetration testing security compliance third-party security threat management

Share This Story

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Ray Overby is co-founder and Chief Technology Officer at KRI Security.


Recommended Content

JOIN TODAY
To unlock your recommendations.

Already have an account? Sign In

  • Security's Top Cybersecurity Leaders 2024

    Security's Top Cybersecurity Leaders 2024

    Security magazine's Top Cybersecurity Leaders 2024 award...
    Security Enterprise Services
    By: Security Staff
  • cyber brain

    The intersection of cybersecurity and artificial intelligence

    Artificial intelligence (AI) is a valuable cybersecurity...
    Cyber Tactics Column
    By: Pam Nigro
  • artificial intelligence AI graphic

    Assessing the pros and cons of AI for cybersecurity

    Artificial intelligence (AI) has significant implications...
    Cybersecurity
    By: Charles Denyer
Manage My Account
  • Security eNewsletter & Other eNews Alerts
  • eMagazine Subscriptions
  • Manage My Preferences
  • Online Registration
  • Mobile App
  • Subscription Customer Service

More Videos

Sponsored Content

Sponsored Content is a special paid section where industry companies provide high quality, objective, non-commercial content around topics of interest to the Security audience. All Sponsored Content is supplied by the advertising company and any opinions expressed in this article are those of the author and not necessarily reflect the views of Security or its parent company, BNP Media. Interested in participating in our Sponsored Content section? Contact your local rep!

close
  • Sureview screen
    Sponsored bySureView Systems

    The Evolution of Automation in the Command Center

  • Crisis Response Team
    Sponsored byEverbridge

    Automate or Fall Behind – Crisis Response at the Speed of Risk

  • Perimeter security
    Sponsored byAMAROK

    Why Property Security is the New Competitive Advantage

Popular Stories

Rendered computer with keyboard

16B Login Credentials Exposed in World’s Largest Data Breach

Verizon on phone screen

61M Records Listed for Sale Online, Allegedly Belong to Verizon

Security’s 2025 Women in Security

Security’s 2025 Women in Security

Red spiderweb

From Retail to Insurance, Scattered Spider Changes Targets

blurry multicolored text on black screen

PowerSchool Education Technology Company Announces Data Breach

Events

August 7, 2025

Threats to the Energy Sector: Implications for Corporate and National Security

The energy sector has found itself in the crosshairs of virtually every bad actor on the global stage.

August 27, 2025

Risk Mitigation as a Competitive Edge

In today’s volatile environment, a robust risk management strategy isn’t just a requirement—it’s a foundation for organizational resilience. From cyber threats to climate disruptions, the ability to anticipate, withstand, and adapt to disruption is becoming a hallmark of industry leaders.

View All Submit An Event

Products

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

See More Products

Related Articles

  • the cloud

    Encryption and Authentication: The One-Two Punch That Protects Your Data

    See More
  • Penetration Testing by Letter of the Law

    See More
  • GDPR and data protection in today's legal landscape

    Penetration testing in the modern regulatory and legal landscape

    See More

Related Products

See More Products
  • GSEC.jpg

    GSEC GIAC Security Essentials Certification All-In-One Exam Guide, 2E

  • CASP.jpg.jpg

    CASP+ CompTIA Advanced Security Practitioner Certification All-In-One Exam Guide...

  • 150 things.jpg

    The Handbook for School Safety and Security

See More Products
×

Sign-up to receive top management & result-driven techniques in the industry.

Join over 20,000+ industry leaders who receive our premium content.

SIGN UP TODAY!
  • RESOURCES
    • Advertise
    • Contact Us
    • Store
    • Want More
  • SIGN UP TODAY
    • Create Account
    • eMagazine
    • eNewsletter
    • Customer Service
    • Manage Preferences
  • SERVICES
    • Marketing Services
    • Reprints
    • Market Research
    • List Rental
    • Survey/Respondent Access
  • STAY CONNECTED
    • LinkedIn
    • Facebook
    • YouTube
    • X (Twitter)
  • PRIVACY
    • PRIVACY POLICY
    • TERMS & CONDITIONS
    • DO NOT SELL MY PERSONAL INFORMATION
    • PRIVACY REQUEST
    • ACCESSIBILITY

Copyright ©2025. All Rights Reserved BNP Media.

Design, CMS, Hosting & Web Development :: ePublishing