The commoditization of penetration testing

Pentesting now seems like a dirty word.

This struck me when I was reading Open AI’s recent post “Advancing red teaming with people and AI”, where they essentially describe pentests against their LLM. Anecdotally, it seems that suppliers are rebranding their pentest services to “red team engagements” to stay relevant.

This observation is in a market where many OG pentest vendors have been acquired and rolled in to the consulting arms of multinationals, their identity slowly being forgotten. New vendors have popped up, but they’re mostly competing on price in a race to the bottom.

Automation in the SDLC, default defences included in development frameworks, and effective EDR has also chipped away at the premise (and budget) for pentests.

Are pentests still required? Or are they only for compliance?

Personally I think many public-facing apps would be better served by enlisting in a bug bounty program instead of a pentest.