How Pentera is Revolutionizing Automated Security Validation for Cloud Environments

Pentera – the market leader for Automated Security Validation – recently launched the first-ever software product enabling on-demand security testing and resilience assessment of corporate cloud accounts against cloud-native attacks. Where most organizations today are performing single cloud pentesting, which tends to be costly and limited, Pentera Cloud automates cloud pentesting to secure cloud environments – it enables on-demand testing for the scale of modern attack surfaces and the speed of dynamic cloud environments. By emulating real attacks with the creativity of experienced threat actors, the solution empowers customers with the context of how attacks start in one part of their attack surface and can impact other aspects. 

We sat down with Ran Tamir, Chief Product Officer of Pentera to discuss the recent launch of Pentera Cloud and how it will revolutionize pentesting for dynamic cloud environments.

What is automated security validation and why is it important for organizations to understand?

Automated Security Validation (ASV) is a new approach to validating the effectiveness of an organization’s security controls based on automated attack emulation. By emulating threat actors’ tactics, techniques, and procedures (TTPs), ASV pinpoints the effectiveness of the organization’s existing security controls and policies and where threat actors can circumvent them. 

Pentera’s recent State of Pentesting 2024 report found that despite an average of 53 security solutions across the enterprise, 51% of CISOs had reported being compromised by a breach in the past year. This highlights a fundamental issue with security because it’s not a lack of investment. Our report also highlighted that although 73% of CISOs report changes to their IT environments on at least a quarterly basis, only 40% tested their security as frequently. 

While many organizations pentest, traditional pentests tend to happen once or twice a year at most, leaving organizations open to risk for extended periods of time. ASV enables organizations to scale their security testing and validation practices to ensure they are constantly sure of their security against real world threats.

Many businesses today are expanding their workflows and data to the cloud. How has this switch affected organizations’ exposure to risk?

Cloud environments are attractive to organizations for numerous reasons, but the primary attraction resides in the scalability and flexibility of the environment. Due to this, many businesses have migrated or plan to migrate data and workflows to the cloud. But with this transition comes a whole new set of cybersecurity challenges, specifically cloud-native threats. 

Compounding the issue is that many organizations that operate in hybrid cloud environments tend to use a combination of providers and on-premises infrastructure. This increases the number of possible threat vectors, leaving organizations vulnerable to exploitation. Understanding the risks that the cloud causes organizations today, our team recently launched Pentera Cloud – the first software product enabling on-demand security testing and resilience assessment of corporate cloud accounts against cloud-native attacks.

You recently introduced Pentera Cloud, can you explain the core capabilities and why you expanded to the cloud?

Pentera Cloud is the newest addition to Pentera’s ASV platform. It is the first automated pentesting tool designed for the scale of modern attack surfaces and the speed of dynamic cloud environments. Challenging existing security controls and policies to validate their effectiveness, Pentera Cloud identifies exploitable gaps across Cloud environments. With Pentera Cloud organizations benefit from:

• Automated cloud attack emulation: Pentera Cloud automatically maps the organization’s AWS and Azure environments, identifying cloud resources, identities, workloads, and data. The algorithmic engine emulates cloud-native attacks, including moving laterally across workloads, to test the organization’s resilience against cloud attack techniques mapped to the MITRE ATT&CK framework.

• Cross-Attack Surface Testing – Increasingly complex hybrid environments open new possibilities for malicious hackers to gain a foothold within an organization. Pentera Cloud applies the creativity of experienced threat actors, utilizing data discovered within your cloud ecosystem to move laterally to exploit on-premises environments. And vice versa.

• Evidence-based remediation: Pentera Cloud leverages kill-chains analysis and the unique context of the organization’s cloud environment to validate exposure and provide prioritized remediation guidance accordingly.

How is Pentera Cloud different from other cloud solutions on the market like CNAPP and CSPM offerings?

Cloud Security Posture Management (CSPM) and Cloud Native Application Protection Platforms (CNAPP) are very important tools that every security team needs, but they differ from ASV in a fundamental way. Existing tools like CSPM are concerned with cloud configuration scanning, and checking existing configurations for compliance with industry regulations, standards, and security best practices. These offerings check the theoretical risk based on the parameters – they are not designed to validate your posture against real-attack scenarios and tactics. 

Through real-attack emulation, Pentera Cloud enables security teams to see exactly how an attack can impact their production environment. This ultimately allows organizations to not only properly identify, but also prioritize the remediation security gaps outlined by their CSPM/CNAPP tools to increase their overall efficiency. 

As part of this offering, Pentera Cloud provides prioritized, evidence-based remediation guidance for organizations: Can you tell me more about how this works?

Traditional vulnerability management helps organizations identify their vulnerabilities and advises on prioritization. Oftentimes, the suggested order of remediation is based on metrics like a CVSS score. CVSS scores are effective at outlining the theoretical danger associated with a given vulnerability, but the score doesn’t reflect the true exploitability of that vulnerability within your environment. The other shortcoming of traditional vulnerability management is that it cannot account for non-patchable issues such as misconfigurations or business logic flaws. 

Emulating the TTPs that threat actors are using in the wild, Pentera showcases where existing security protocols are working and where hackers can successfully breach the organization. Seeing the full kill-chain enables security teams to understand their true security gaps and prioritize threats based on proven attacks.

For example, within the attack chain, Pentera may show that what you thought was a simple misconfiguration could actually lead to a mission-critical asset, while a 10/10 vulnerability leads to nothing. By understanding that context, security teams can understand which they should prioritize first.