[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnkyJGEHwZ07g3BTEROAIbRPADlZUuPuJhHnb0sk7BRg":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"b1289ba2-f88b-4fe4-a301-07209c0a1f36","What 345 Days of Untested Exposure Looks Like at a Bank","what-345-days-of-untested-exposure-looks-like-at-a-bank-e419cb","A two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change. [...]","A two-week annual penetration test leaves roughly 345 days of real-world exposure unvalidated, creating significant risk in modern banking environments where infrastructure changes continuously. Regulators (PCI DSS, FFIEC, NYDFS) already expect testing to occur in response to changes—cloud migrations, fintech integrations, M&A work—not just annual assessments. A recent engagement at a regional bank uncovered an unauthenticated API endpoint on a third-party mortgage platform that exposed staff records and internal codes for every financial institution using the shared infrastructure.","Annual penetration tests leave 345 days of banking exposure unvalidated amid constant infrastructure changes.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fwhat-345-days-of-untested-exposure-looks-like-at-a-bank\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F06\u002F02\u002Fsprocket-header.jpg","2026-06-03T14:02:12+00:00","2026-06-03T16:00:21.51446+00:00",7,[17,20,22,24],{"name":18,"type":19},"Marquis Software","vendor",{"name":21,"type":19},"Sprocket Security",{"name":23,"type":19},"CrowdStrike",{"name":25,"type":19},"Mandiant","53f9c4b6-8bc6-4964-9169-d09e5cd41d72",{"id":26,"icon":28,"name":29,"slug":30},null,"Compliance","compliance",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":48},{"id":49,"icon":28,"name":50,"slug":51},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[23,18,21],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":86,"name":87,"problem":88,"products":89},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"slug":115,"name":116,"problem":117,"products":118},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"pentera","Pentera","\u002Fvendor-logos\u002Fpentera.png","pentera-platform","Pentera Platform","https:\u002F\u002Fpentera.io\u002Fpentera-platform\u002F","Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"hackerone","HackerOne","\u002Fvendor-logos\u002Fhackerone.png","pentest","HackerOne Pentest","https:\u002F\u002Fwww.hackerone.com\u002Fproduct\u002Fpentest","Penetration testing delivered by vetted researchers.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":155},"annual-penetration-testing-leaves-345-days-of-unvalidated-risk","Annual Penetration Testing Leaves 345 Days of Unvalidated Risk","A regional bank's reliance on annual penetration testing left 345 days of exposure unvalidated, during which an unauthenticated API endpoint on a third-party mortgage platform exposed sensitive staff records. Modern banking environments change continuously through cloud migrations, fintech integrations, and M&A activities, making annual security assessments insufficient. Regulators like PCI DSS, FFIEC, and NYDFS already require testing in response to infrastructure changes, not just scheduled annual reviews. This incident demonstrates how shared third-party platforms can amplify security vulnerabilities across multiple financial institutions simultaneously.",[149,150,151,152,153,154],"CIS Control 7","NIST SP 800-53 RA-5","PCI DSS 11.3","FFIEC IT Examination Handbook","NYDFS 23 NYCRR 500.15","ISO 27001 A.12.6.1",{}]