Penetration Testing Is Busted: Introducing a Continuous Testing Methodology

Paul Petefish

Abstract:

Traditional penetration testing was designed for a world where infrastructure changed slowly, deployments were infrequent, and threat actors operated at human speed. That world no longer exists.
Today’s environments are dynamic, cloud-native, and continuously evolving – yet penetration testing remains largely static, delivered as point-in-time assessments that quickly become obsolete.
This talk introduces the Continuous Penetration Testing Methodology (CPTM), a structured, tool-agnostic framework designed to modernize offensive security by aligning testing cadence with the pace of change.
CPTM extends and exceeds the rigor of established standards such as NIST SP 800-115, PTES, OWASP, and MITRE ATT&CK by transforming penetration testing from an episodic event into an always-on security function. The methodology formalizes continuous reconnaissance, attack surface monitoring, human-led validation, exploitation, and iterative risk reduction – while preserving the discipline, repeatability, and reporting expectations required by enterprises and regulators.

Paul Petefish

Evolve Security, President & Chief Strategy Officer

Paul Petefish is an offensive cybersecurity leader, entrepreneur, and researcher with over 20 years of experience in cybersecurity. He is a former penetration tester turned cybersecurity leader and the co-founder of Evolve Security, where he has spent the last 10 years building next-gen offensive cybersecurity solutions.
Paul is the author of the Continuous Penetration Testing Methodology (CPTM), a structured, tool-agnostic framework designed to modernize traditional penetration testing by aligning it with the pace of today’s cloud-native, continuously evolving environments. CPTM builds on and exceeds established standards such as NIST SP 800-115, PTES, OWASP, and MITRE ATT&CK by transforming penetration testing from a point-in-time assessment into an always-on security control.
In addition to leading Evolve Security, Paul is a patent holder and an active security researcher, with published vulnerability research. He’s been a guest lecturer at the University of Chicago, a frequent speaker at cybersecurity conferences, and a recognized cyber expert for ABC and CBS Chicago, where he provides commentary on cybersecurity threats and incidents.
Paul is passionate about advancing the offensive security discipline and redefining how organizations measure and manage cyber risk in an era of constant change.