Kirk Hanratty is the CTO and co-founder of SynerComm. Focused on proving controls stop real attacks, not just that they exist.
Organizations have more security controls than at any point in history, and they still get hacked. Global cybersecurity spending has climbed every year since 2020 and hit a record $213 billion in 2025, forecast to reach $240 billion in 2026 (Gartner). Despite that, the average cost of a data breach also hit a record high in 2026, up 12% year over year.
That is not a contradiction. It is a measurement problem, and a programmatic one. Most programs can tell you which controls exist and whether they are configured to a standard. Almost none can tell you whether those controls are tuned to actually stop an attacker right now.
Configuring a control and proving it works are two different jobs. We do both at our company. We source, deploy and configure security technology for clients. We do not operate it. The client directs and approves every configuration to meet their standards. We also provide continuous penetration testing, an independent measure of whether the resulting stack actually prevents, detects and responds to real attack behavior. The first job is building to a standard. The second is proving that standard stays tuned as your business and the threat environment change.
A VPN, or the secure web gateway that has largely replaced it, can be configured exactly as designed and still have nothing to do with why an attacker got through. The decision that actually mattered, whether a password was easily guessable, was never that control’s job. That decision gets handed off, through an authentication protocol, to the directory or identity services running underneath it. A control can pass every configuration check and still be the first thing an attacker gets past. Identifying and confirming that control gap requires an adversarial view of a company’s footprint, while mitigating the finding requires a full-stack view of how the layers work together. A qualified, expert challenge of the system is beneficial to all.
The same is true of multi-factor authentication. It is often assumed to close the gap a weak password opens—and it can, until you find the legacy protocol that never supported it or the privileged account someone excluded to make an old tool work.
Configuration Checks Were The First Step—Efficacy Testing Is The Next One
Security measurement has moved in stages. At first, the question to ask was, “Does the control exist?” Then, it evolved to, “Is it configured correctly?” Neither tells you whether the control does its job today, which depends on how well it was integrated with everything else in the stack. The only way to know is purple team testing against real, documented attack behavior, not a theoretical one.
The next step in that evolution is testing efficacy directly, running real attack scenarios on a defined cadence (not just once) and measuring what happens. You then need to use that result to build a baseline and a feedback loop, tuning the stack against what the test found and testing again. Not “Is this configured to spec?” but “Did this stop the attack, how fast and what changed because we found out?” That loop is the only thing that moves when the threat changes, because it measures against the threat, not a checklist.
AI is the clearest place this shows up right now. A client’s AI workflows—and the prevention, detection and response controls wrapped around them—can be fully configured to a standard and still fail the moment someone runs a real attack against them. An attacker crafts input that talks a model into ignoring its own guardrails. No configuration review catches that. It has to be tested directly, tuned against what the test finds and tested again. Where testing risks disrupting production, like account lockouts on identity systems, we run it through manual playbooks instead of automated tools.
This Is Not A Compliance Argument, Though Compliance Got Here First
PCI DSS requires a penetration tester be organizationally independent from whoever manages or maintains the system being tested, a rule written because this conflict was already familiar enough to need one. Most of what we are describing has nothing to do with PCI DSS. The principle holds without a regulation forcing it, because the underlying question (“Is this still tuned to work?”) is not a compliance question. Attestation checks a point in time. A properly configured environment 18 months ago might be ancient history if nobody has retested and retuned it since.
Outsourcing Moves The Problem, Not The Accountability
Most enterprise environments have outsourced 24×7 detection and response for a decade or more, since scaling it in-house rarely pays off. Modern solutions are split across a platform vendor’s own SOC, agnostic overlay services or newer AI SOC models.
None of that changes the question. Someone still has to independently confirm whichever model a client picked actually stops real attack paths, how fast it recognizes an incident and whether it stays tuned as a client’s initiatives, people, process and technology all keep moving.
Some clients run this as a broad simulated attack. Others schedule quarterly purple team exercises built around one specific scenario, tested and retuned. Each quarter targets a different scenario, growing more sophisticated as it builds on what came before. Either way, we do not operate that layer ourselves. We measure whether it delivers, then measure again. Some vendors now offer this testing themselves, funded through unused incident response retainer credit, which is useful for validating specific scenarios. You have to decide if it passes the separation of duties requirements for your environment.
What This Means For The People Who Have To Answer For It
If you are a CISO or a board member, the question is no longer whether you are compliant. It is whether you have a periodic feedback loop that identifies gaps and tunes your stack to stop what attackers are doing right now. Most cannot answer that today. They can point to controls they bought and how they are configured. They cannot point to evidence those controls are still closing the gaps that matter. That gap is where the next few years of this industry get decided, and organizations that build the loop now will not be scrambling to build it under a regulator’s deadline.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
