Lindsay Usherwood and Anthony Pillitiere of Horizon3.AI break down autonomous penetration testing and how an offensive approach can help businesses focus on the cybersecurity risks that matter most.
Cybersecurity teams have more information than ever. Vulnerability scans, alerts, patches, and reports can uncover thousands of potential problems across an organization.
With so much information coming in, how do you know which risks actually deserve your attention?
In this episode of Techless with Lindsay, I sat down with Anthony Pillitiere, co-founder of Horizon3.AI, to discuss autonomous penetration testing, cybersecurity prioritization, and how an offense-driven approach can help businesses better understand their security risks.
Every vulnerability can look urgent when it shows up on a report.
The problem is that IT teams only have so much time and so many resources available to address them.
Anthony Pillitiere explained that one of the biggest challenges in cybersecurity is prioritization. There can be thousands of vulnerabilities within your organization but only a small percentage are actually exploitable.
For businesses, that context can make security decisions much clearer.
Which weaknesses can actually be exploited? Where could an attacker go from there? What systems or data could they reach?
Those questions bring an offensive perspective into cybersecurity.
Taking an offensive approach means looking at your environment from the perspective of the person trying to attack it.
Anthony Pillitiere refers to this philosophy as offense-driven defense. The idea is to test an environment from multiple perspectives to better understand how an attacker could move through it.
Instead of waiting for an actual attack to reveal a gap, teams can proactively test their own environment and use those findings to decide where to focus their attention.
Autonomous penetration testing plays an important role in this offensive approach.
Traditional penetration testing relies on human testers and still provides significant value. However, Pillitiere explained that these assessments can be limited by scope and frequency. A manual pen test may focus on a smaller set of critical systems, leaving other areas where attackers could find credentials, misconfigurations, or weaknesses that create another path into the business.
Autonomous penetration testing provides a broader view of the environment and can be performed more frequently, helping businesses understand how individual weaknesses connect, prioritize what needs attention, and create clearer action plans for remediation.
One of my favorite explanations from the conversation was Anthony Pillitiere’s analogy of looking at a forest.
Vulnerability scanning is like looking at the knots on individual trees. Manual penetration testing can give you a closer look at a smaller set of trees. Autonomous testing can provide a wider view of the forest and examine the entire environment from different perspectives.
That wider perspective matters because attackers may not go directly after the system you expect them to.
They can find credentials, misconfigurations, or weaknesses elsewhere and use them to move through an environment. That led to one of the most memorable lines from the episode:
We often picture hacking as someone directly breaking through a company’s strongest defenses. Anthony Pillitiere explained that attackers may find credentials, misconfigurations, or other weaknesses elsewhere in the environment and use them to gain greater access.
Eventually, they may not need to “break into” a well-protected system at all. They have the access they need to log in. “Hackers don’t hack in, they log in.”
That’s why looking at the entire environment matters. Understanding how an attacker could move from one weakness to another can reveal attack paths that a narrowly focused test might miss.
While this part of our conversation didn't make the final video, Anthony Pillitiere also shared his perspective on how often businesses should be testing.
Traditional penetration tests are often performed annually, but that can leave long periods where changes in your environment introduce risks you haven't tested yet. Autonomous penetration testing makes it possible to assess security much more frequently. Anthony Pillitiere recommends testing weekly, if not more often, with some organizations running certain assessments every day.
Pillitiere shared an example of an organization running regular password audits. After changing a service account password, the next audit cracked the new password. They changed it again, and the following audit cracked that one too. It took three changes before the password could no longer be cracked.
Frequent testing gives teams the opportunity to find risks as their environment changes, take action, and then retest to verify whether the issue was actually resolved. This turns penetration testing from a periodic snapshot into a more continuous view of security risk.
Looking ahead, the conversation turned to what continuous cybersecurity could eventually look like.
Anthony Pillitiere described a find, fix, verify approach in which organizations regularly find exploitable weaknesses, fix them, and then verify that the remediation worked.
The goal is to create a continuous cycle that can respond as environments and threats change.
For businesses, the concept comes back to something simple: knowing that you made a security change is useful. Being able to verify that it addressed the risk provides another level of confidence.
Cybersecurity threats aren't standing still, and neither are the environments businesses are trying to protect.
An offense-driven approach gives organizations another way to understand their risk by viewing their environment from an attacker's perspective. Autonomous penetration testing can help uncover possible attack paths, more frequent testing can reveal how risk changes, and prioritization can help teams' direct resources toward the weaknesses that matter most.
You can't eliminate every cybersecurity risk. But you can work toward a better understanding of what an attacker could actually do in your environment.
And that understanding can help your team make smarter decisions about what to fix first.
Want to learn more about autonomous penetration testing and offense-driven cybersecurity? Fill out a tech evaluation to see how we can help you build a system that's actually working for you.