2023年渗透测试报告（英）-37页_1mb

Introduction and Objectives
The 2023 Fortra Penetration Testing Survey explores how organizations use penetration testing, highlighting annual trends, challenges, and strategies. It surveys cybersecurity professionals to provide insights on evolving security threats and the effectiveness of pen testing. Key findings include a slight shift in penetration testing's role, driven by rising global security concerns and economic influences.

Top Security Concerns

• Ransomware (72%), phishing (70%), and misconfigurations (58%) remain the most pressing threats.
• Phishing persists due to human factors, with a 8 percentage increase in monthly phishing simulations.
• Other concerns include unintentional internal threats (54%), supply chain attacks (44%), and areas like lost devices and weak passwords.

Reasons for Penetration Testing
Organizations primarily use pen testing for risk assessment and remediation prioritization (69%), vulnerability management support (62%), compliance (58%), and internal mandates (40%). These practices help identify security gaps, manage threats, and meet regulatory requirements, with 93% finding it at least somewhat important for compliance initiatives.

Key Challenges and Trends

• Challenges include insufficient resources to address findings, increased demand for skilled personnel, and a 15% drop in confidence evaluation, reflecting the dynamic threat landscape.
• Trends show a modest increase in in-house teams (7%), growth in phishing simulations, and a shift toward hybrid approaches with third-party services and internal capabilities.
• Compliances like GDPR and PCI DSS influence testing strategies, with 41% increasing pen tests and 16% altering scopes or adding staff.

Penetration Testing Practices

• Frequency mostly remains annual or less, with challenges in resource allocation and retesting to validate fixes.
• Third-party services are popular (78% utilization), but in-house teams saw a 7% growth in respondents.
• Tools like vulnerability scanners and automation features are widely adopted, with features such as reporting and multi-vector testing ranked highly.

Conclusion and Recommendations
Penetration testing is critical for reducing cyber risks and improving security postures, despite persistent challenges like resource shortages. Organizations must balance proactive security measures, integrate compliance, and utilize innovative tools to adapt to evolving threats, ensuring continuous improvement and resilience in cybersecurity.