Penetration Testing Is Busted: The Case for Continuous Pentesting | Paul Petefish | BSides312 2026

Traditional penetration testing was designed for a world where infrastructure changed slowly, deployments were infrequent, and threat actors operated at human speed. That world no longer exists Today's environments are dynamic, cloud-native, and continuously evolving – yet penetration testing remains largely static, delivered as point-in-time assessments that quickly become obsolete. This talk introduces the Continuous Penetration Testing Methodology (CPTM), a structured, tool-agnostic framework designed to modernize offensive security by aligning testing cadence with the pace of change. CPTM extends and exceeds the rigor of established standards by transforming penetration testing from an episodic event into an always-on security function --- About Paul Petefish: Evolve Security, President & Chief Strategy Officer Paul Petefish is an offensive cybersecurity leader, entrepreneur, and researcher with over 20 years of experience in cybersecurity. He is a former penetration tester turned cybersecurity leader and the co-founder of Evolve Security, where he has spent the last 10 years building next-gen offensive cybersecurity solutions. Paul is the author of the Continuous Penetration Testing Methodology (CPTM), a structured, tool-agnostic framework designed to modernize traditional penetration testing. Recorded live at BSides312 2026. --- Chapters: 0:00 Introduction 1:00 The Continuous Pentest Methodology 1:45 CVE Velocity Is Up 600% 2:30 Only 74% of Organizations Pentest Annually 3:00 Audience Poll: Who Does This Work? 3:45 Making It a Community Framework 5:00 The Seven Phases 6:00 Three Non-Negotiables 6:15 One: A Dynamic Reporting Platform 6:30 Two: A Discovery and Recon Engine 7:30 Three: Operators, Human and Machine 8:40 What You Actually Need to Build vs. Buy 9:45 Annual vs. Continuous: Frequency 10:15 Findings Delivery and the Exposure Window 10:50 Asset Coverage: Fixed vs. Dynamic Scope 11:30 Remediation in Near Real Time 12:45 Tying Into the CI/CD Pipeline 13:15 Compliance and Attestation 14:15 Snapshots as Current State 15:00 The Dot Slide 16:00 Traditional Testing, Day by Day 16:30 Continuous: Always-On Recon 17:15 What Drives Each Day's Manual Testing 18:00 A Bug Bounty Style Approach 18:45 Advanced Scenarios and TTP Playbooks 19:15 Framework Alignment: NIST 800-115, PTES, OWASP 20:15 Auditors Haven't Pushed Back 21:45 How to Contribute 23:15 Q&A: What Drives the Daily Cadence 24:45 Q&A: Does AI Change Vulnerability Management? --- Mentioned in this talk: - Continuous Pentest Methodology (CPTM), on Evolve Security's GitHub - NIST 800-115 - Penetration Testing Execution Standard - MITRE ATT&CK - OWASP Top 10 Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw