Continuous Penetration Testing: A Snapshot Of A Snapshot

Estimated reading time: 7 minutes

Attackers now often exploit a flaw before a patch exists. In a conversation with Cyber Insurance News, Revelion’s Mitchell Spicer said annual penetration tests can’t keep pace. Neither can the underwriting built on them. His company sells continuous penetration testing.

“An annual pen test is a snapshot, and annual underwriting is a snapshot of that snapshot,” Mitchell Spicer said.

Spicer is co-founder and chief operating officer of Revelion, a London company that sells autonomous AI penetration testing. Its software runs simulated attacks on a client’s systems, as an outside attacker would. Revelion says it reports only the weaknesses it can demonstrate.

Mitchell Spicer, co-founder and COO of Revelion, wearing a black T-shirt in a bright open-plan office — Mitchell Spicer, co-founder and chief operating officer, Revelion. Photo courtesy of Revelion.

Revelion sells frequency. It offers 52 scheduled tests a year against what it calls the “364-day gap” of a yearly test. Spicer’s argument and his company’s sales pitch point the same way. The independent evidence on attack speed supports his starting point.

Penetration Testing On A Yearly Calendar

A penetration test is an authorized attack. Testers try to break into a company’s systems, then report what worked. Payment card rules set a common rhythm. PCI DSS requires internal and external penetration tests at least once every 12 months, and after any significant change.

Attackers keep a faster schedule. Mandiant’s M-Trends 2026 report put the mean time to exploit a vulnerability at an estimated minus seven days in 2025. Attackers routinely struck before vendors even released a patch, Mandiant said. Exploits were also the most common way into networks for the sixth year running, at 32% of intrusions.

AI now does some of the testing, too. Revelion’s lead agent plans an engagement and directs specialist agents through reconnaissance, exploitation, and validation. The company says its engine refuses destructive actions unless the agreed scope allows them. That matters. Cyber Insurance News reported on Terra Security’s agents testing internal networks, and on who pays if one causes an outage.

Bar chart of Mandiant time to exploit falling from 63 days in 2018 to 2019 to an estimated minus seven days in 2025, meaning attackers now often strike before a patch, produced by cyber insurance news. — Attackers once took about two months to exploit a flaw after its patch. Mandiant estimates that in 2025 they struck a week before it, on average. **Source: Mandiant.**

Continuous Penetration Testing And The Underwriting Lag

Spicer laid out the risk as a timeline. “With AI-enabled attackers probing continuously, a company could pass its test in January, be breached in March and still be assessed using evidence that no longer reflects its current security posture,” he said.

He expects underwriting to change. “As continuous testing becomes more accessible, I expect insurers to start asking for evidence of frequent testing rather than a single yearly report,” Spicer said.

That is his forecast, and it suits his business. Insurer requirements do move security budgets, though. Kaseya asked managed service providers what most drives their clients’ security spending. Twenty percent named compliance or cyber insurance requirements, as many as named a recent incident.

Cyber Underwriting Means Underwriting The Supply Chain

On third-party risk, Spicer starts at home. “Test your own house first,” he said. “Before you audit a single supplier, you need to know your own security is being tested and is holding, or you’re asking vendors for assurances you can’t give yourself.”

Certifications help, he said, but they set a minimum. “ISO 27001 and SOC 2 Type II are a floor, not a ceiling,” Spicer said. “They provide valuable assurance, but they don’t replace ongoing visibility into how a supplier’s security holds up over time.”

Cyber Tzar CEO Andrew Horkan described that gap on the Cyber Insurance News podcast. A defense supplier held NIST, SOC 2, ISO 27001 and Cyber Essentials Plus. It was compliant on paper from January to May. In June, after a quiet server move, more than 17,000 ports were open. Without monitoring, Horkan said, the gap would have sat open until the next annual review.

Spicer wants businesses and insurers to ask suppliers for evidence of frequent testing, “because a supplier’s gap can become your breach.”

“Underwriting a company today means underwriting its supply chain, whether the policy says so or not,” he said.

Our Latest Podcast

“I’m going to come after your third-party suppliers.” On the CINI podcast, CDL Cyber Intelligence CEO Jonathan Palmer explains how attackers pick a way in. Watch or listen to Think Like A Criminal.

Cyber Insurance News & Information (CINI) podcast on dark web monitoring with CDL Cyber Intelligence, Think Like A Criminal, Act Like An Angel, over a rain-soaked alley with a green-lit doorway

Two Incidents, One Cyber Underwriting Question

“One incident can be bad luck,” Spicer said. Two in a short period should push an underwriter past the perimeter, he said, toward remediation and training. His questions: “What changed after the first incident, and was the fix actually tested?”

Repeat attacks are common among ransomware victims who pay. In CrowdStrike’s 2025 ransomware survey of 1,100 security leaders, 83% of organizations that paid faced another attack.

Finding a weakness is only the first step. Horkan described a client that paid £25,000 for a penetration test and had nothing left to fix what it found. Spicer looks at the whole cycle. “When incidents occur repeatedly, it’s worth asking whether that loop of finding, fixing and verifying vulnerabilities is working as it should,” he said.

Who Checks The Penetration Testing Evidence?

Continuous penetration testing raises a question for underwriters. A test the insured buys from a vendor is still evidence the insured hands over. Some brokers already run their own checks. Horkan said one broker uses Cyber Tzar’s outside-in score before binding. A low score can mean fixes first.

Spicer sees the market behind on both counts. “Right now, there’s a lag between the threat and how often companies test, and a second lag between that and what underwriters require,” he said. “Both need to close.”

FAQ – Continuous Penetration Testing

What is continuous penetration testing?

Testing a company’s defenses with authorized attacks on a regular schedule instead of once a year. Revelion runs AI agents that test as often as weekly.

Can annual underwriting keep pace with cyber threats?

Revelion co-founder and COO Mitchell Spicer says no. A company could pass a test in January, be breached in March and still be assessed on the January evidence.

How fast do attackers exploit vulnerabilities?

Mandiant’s M-Trends 2026 put the mean time to exploit at an estimated minus seven days in 2025. Exploitation often came before a patch was released.

Will insurers ask for more frequent testing?

Spicer expects insurers to start asking for evidence of frequent testing instead of a single yearly report. That is his forecast. Revelion sells frequent testing.

Are ISO 27001 and SOC 2 enough to judge a supplier?

Spicer calls them “a floor, not a ceiling.” He says businesses and insurers should ask suppliers for evidence of frequent testing.

What should two incidents tell an underwriter?

Spicer says one can be bad luck. After two in a short period, he would ask what changed after the first incident, and whether the fix was tested.

Martin Hinton

Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.