Home / Resources
How crews get in right now.
What attackers are doing and how your testing options compare.
Four ways in that we see most.
Updated November 2026 by the WhatsExposed testing team. According to Verizon’s 2026 Data Breach Investigations Report, exploited weaknesses have overtaken stolen passwords as the most common way in for the first time in 19 years.
Breaking in through VPNs and firewalls
Crews scan the internet for VPNs and firewalls with a newly published flaw.
We test: Everything you expose online, again whenever a new exploit appears.
Signing in with stolen passwords
Stolen logins used to sign straight in to Microsoft 365, VPNs and remote desktops.
We test: Microsoft 365, Active Directory and sign-in controls, plus phishing.
Coming in through suppliers
One weak supplier can open a door into every business it connects to.
We test: How far a supplier’s access could reach inside your network.
Attacks sped up by AI
Attackers use AI to find weaknesses, while tools like Copilot can reach more company data than they should.
We test: New attack techniques, and what your AI tools can see.
How the options compare.
Year-round testing gives you the depth of a yearly test and the coverage of a platform.
| Annual pen test | Automated platform | WhatsExposed year-round | |
|---|---|---|---|
| When you’re tested | Once a year | Whenever you run it | At the start, then after every change |
| Who checks findings | A tester | Usually no one | A certified tester, with severity set by a Team Lead |
| What to fix first | Ranked once a year | Long lists, little context | A fix-first list, kept current all year |
| Use of AI | Varies | Always, often with no one checking | Your choice, with every finding confirmed by a tester |
| PCI DSS Requirement 11.4 | Annual test only | Not enough on its own | Annual test and testing after change |
| Web apps and cloud | Scoped separately | Varies | Included |
| Retests | Usually extra | Automated rescans | Unlimited, confirmed by a tester |
| How it’s bought | Per test | Per asset or IP, with true-ups | One retainer, no per-asset charges |
| For MSPs | Rarely white-labeled | Co-branded reports at best | Fully white-labeled |
Longer reads.
- What is continuous penetration testing?How it differs from annual tests, what frameworks require and what it costs.
- PCI DSS penetration testing, Requirement 11.4What it asks for and how year-round testing covers it.
- Optional AI-assisted penetration testingWhat AI tooling does and why it’s off unless you opt in.
- External network penetration testingWhat gets tested and what you get at the end.
The questions we get asked most.
How is year-round testing different from an annual pen test?
You still get a full penetration test at the start. After that we test new systems as they appear, try relevant new attacks against you, keep your fix-first list current and retest fixes as often as you need, all under one retainer.
What does the first look involve?
Give us your domain and a tester checks what your business exposes to the internet, using only what is already public. Nothing is sent at your systems, and a tester is in touch within 24 hours.
Do you use AI in testing?
Only if you want us to. Every test is led by a certified tester. If you opt in, AI-assisted tooling handles routine work such as mapping what you expose and spotting changes. A tester still exploits and confirms every finding, and a Team Lead signs the report. Opting in costs nothing extra.
Is AI or automated penetration testing enough for compliance?
Not on its own for PCI DSS. Requirement 11.4 asks for a qualified tester who is independent of your IT team, and most SOC 2 auditors and insurers expect the same. That’s why every finding we report is confirmed and signed by a certified tester.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan is automated and lists known weaknesses. A penetration test has a person exploit those weaknesses, chain them together and show what an attacker could actually reach.
How often should a business be penetration tested?
At least once a year and after any significant change, which is what PCI DSS requires. Businesses whose systems change often get more from testing throughout the year.
How do you keep our data safe?
We’re certified to ISO/IEC 27001:2022. Findings are encrypted in transit and at rest, hosted in Microsoft Azure in Ireland with a UK-only option, and only the people working on your engagement can see them. You own all your data and reports, and the platform is independently penetration tested every year.
Can I choose what gets tested?
Yes. We agree the scope with you at the start, and we only actively test systems you’ve approved in writing.
Do you work with MSPs?
Yes. MSPs sell our testing fully white-labeled, co-branded or by referral.
See what a year of testing costs.
One retainer for the whole year, with no charge per IP address or asset.