Rob Deane
Associate Managing Director
Cyber Risk
New York
Agile Penetration Testing Program
Integrated into your software development lifecycle (SDLC), Kroll’s agile penetration testing program is designed to help teams address security risks in real time and on budget.
Talk to an ExpertWhat is Agile Penetration Testing?
Agile penetration “pen” testing is a continuous security assessment approach that allows companies to speed up secure software delivery to their customers.
Traditionally, penetration tests occur on an infrequent, “point in time” basis within the scope of a product release cycle or based on compliance mandates. This approach may fit if you still use the waterfall method, but it falls short if you use agile or other continuous development methodologies.
Unlike traditional pen testing(which tends to slow down product teams), when properly integrated within the SDLC, agile penetration testing can keep pace with your release schedule. The result: saving your business the time and expense of having to remediate long-standing problems that could have been identified much earlier in the process.
Agile pen testing is a programmatic way to unearth and remediate potential risks in an application within the existing timelines and schedules of product releases. Just as features are added or updated constantly during sprints, continuous penetration testing can make sure that the security of those new features are being tested just as frequently.
Merging Product, Development and Security For Greater Efficiency
Many product teams have adopted agile software development methodologies but have not integrated pen testing into the agile process. For most, penetration testing remains a standalone process performed alongside other annual assessments. Our agile pen testing programs integrate into your product team’s software development lifecycle to reduce the timespan between code changes and security assessments, so code is not released to production with unknown risks.
The program is designed based on strong fundamentals in program planning and onboarding with teams to ensure minimal disruption to current engineering processes. Kroll’s dedicated program team aims to build institutional knowledge by providing continuity, expertise and support for making technical decisions with security in mind.
The Agile Assessment Lifecycle
A view into a standard deployment of the agile penetration testing program:
Managed Agile Pen Testing Program Overview
In contrast to the usual method of conducting a security assessment by means of a pen test near the end of the release cycle, Kroll’s developer-centric security consultants engage with product engineering and project management teams to identify and remediate security vulnerabilities throughout the entire product release cycle.
This agile approach helps ensure that every product release, be it a minor bug fix or a major feature release, has been vetted from a security perspective. The solution model covers the following:
- Enhancing the development sprint plans to include the appropriate level of security assessment required
- Strategizing “abuse cases” for every release through a rapid threat modeling exercise ahead of development
- Validating countermeasures to the said abuse cases, along with exploratory threat scenarios through an agile pen testing exercise post development
- Logging of any potential vulnerabilities directly on development platforms, such as JIRA, Azure DevOps, etc., for remediation
- Validating the applied fix (remediation) by conducting an optional retesting exercise
- Analyzing vulnerability patterns, scoring, time to fix and other critical statistics and communicating program improvement opportunities in sprint recaps
Onboarding and Program Development | Management | Tracking and Reporting |
|---|---|---|
Key activities include:
| Throughout the program, each test is carefully considered:
| Efforts can tracked via a variety of reports and adjusted for key stakeholders:
|
Key Benefits – The End Results
The efficiency and flexibility of agile, with a more secure product:
Cyber Insurance Preferred Partner
Kroll has a dedicated team for insurance and legal channels, with extensive relationships with 50+ cyber insurance brokers and carriers worldwide and exclusive benefits to insureds.
Endlessly Adaptable
Development and security teams seamlessly communicate to cater testing to new features and priorities.
Fewer Vulnerabilities
Over time, the backlog of software vulnerabilities decreases.
Native Security
Ongoing feedback and collaboration helps developers implement better secure development practices in new code.
Why Kroll?
- Our team conducts more than 53,000 hours of cyber security assessments every year and carries well over 100 security certifications encompassing offensive security, cloud, penetration testing, mobile, and web testing.
- Senior team members have each spent decades working in cybersecurity and our award-winning penetration testers are certified to some of the highest global industry standards, including CHECK, CREST (CCT/CRT) and SANS (GIAC).
- Kroll handles over 3,000 incident response cases worldwide every year, enabling us to leverage the latest frontline threat intelligence and adversary mindset in every engagement.
- Our testers have diverse backgrounds in information technology, application development and cyber investigations. This experience enables them to anticipate evolving and emerging cyber threats for our clients across industries and jurisdictions.
Agile Pen Testing as Part of a Cyber Risk Retainer
Kroll’s ultra-flexible Cyber Risk Retainer can package your agile pen testing needs along with a variety of services like risk assessments, tabletops and red team exercises and more. With the retainer, clients also gain prioritized access to Kroll’s elite digital forensics and incident response team in the event of an incident.
Comprehensive Related Services
All these services can also be available as part of the Kroll Cyber Risk retainer:
- Network Penetration Testing – External and Internal
- Application Penetration Testing – External and Internal
- Web Application Penetration Testing
- IoT Device Penetration Testing
- Dark Web Risk Exposure
- Social Engineering Exercises
- Red/Blue Team Exercises
- Cyber Due Diligence Assessments
Penetration Testing Services
Validate your cyber defenses against real-world threats. Kroll’s world-class penetration testing services bring together front-line threat intelligence, thousands of hours of cyber security assessments completed each year and a team of certified cyber experts — the foundation for our sophisticated and scalable approach.
API Penetration Testing Services
Kroll’s certified pen testers find vulnerabilities in your APIs that scanners simply can’t identify. Protect your business and keep sensitive data secure by leveraging our knowledge and experience in testing modern API infrastructures.
Cloud Penetration Testing Services
Kroll’s team of certified cloud pen testers uncover vulnerabilities in your cloud environment and apps before they can be compromised by threat actors.
Web Application Penetration Testing Services
Assess the design, configuration and implementation of your web apps for critical vulnerabilities. Kroll’s scalable pen testing services consider the business case and logic of your apps, providing more coverage and an optimized program based on risk.
Cyber Risk Retainer
Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.
News
Press Release
Press Release
Kroll named as Major Player in IDC’s Worldwide Cybersecurity Consulting Services 2024 Vendor Assessment
April 25, 2024
Press Release
Kroll Appoints Dave Burg as Global Head of Cyber Risk to Bolster World-Leading Business
March 12, 2024
Press Release
Kroll Expands Cyber Partner Program with MSP Specialization
October 17, 2023
Press Release
Kroll Responder Named as Overall Leader in The KuppingerCole Leadership Compass for Managed Detection and Response Services
August 16, 2023
Events
Cyber
Cyber
Kroll at RSA Conference 2024
May 6 - 9, 2024|Conference
Join Kroll experts at the RSA Conference in San Francisco May 6-9, 2024. Stop by booth 2239 in the South Expo Hall to meet our team.
Threat Intelligence
Q1 2024 Cyber Threat Landscape Virtual Briefing
May 29, 2024|Online
Join the Q1 2024 Cyber Threat Landscape Virtual Briefing as Kroll’s cyber threat analysts outline notable trends and insights from our incident response intelligence.
Kroll is headquartered in New York with offices around the world.
55 East 52nd Street 17 Fl
New York NY 10055
Sign up to receive periodic news, reports, and invitations from Kroll.
Our privacy policy describes how your data will be processed.
© 2024 Kroll, LLC. All rights reserved.
Kroll is not affiliated with Kroll Bond Rating Agency,
Kroll OnTrack Inc. or their affiliated businesses. Read more.