A winning combination for modern cybersecurity

Issue 1 2025 Information Security, Security Services & Risk Management


Wehann Kritzinger

The pressing issue of effective cybersecurity measures weighs heavily on businesses in today’s digital world. Companies are compelled to comply with legislative mandates and, more importantly, to implement appropriate security measures for both their customers and their own most valuable asset – their data. Business reputations and sustainability lie at the heart of these considerations - organisations must meet the challenges of enhancing the efficiency of security measures, while at the same time keeping costs down. It is a tall order.

Penetration testing has, for a long time, been one of the strategic methods that organisations have used to determine their security standing. However, with new technologies being developed and introduced onto the market, Breach and Attack Simulation (BAS) has been identified as the recommended strategy. By implementing BAS in security approaches, organisations can reduce expenses that are normally incurred in penetration testing and at the same time improve their security stance.

BAS is one of the newer concepts that is gaining popularity in the cybersecurity market. It is essentially a set of tools that launch base attacks which are realistic, and take place on a 24/7 basis. They test an organisation’s defences against known threats, misconfigurations, and vulnerabilities, providing meaningful information that does not interfere with business processes. One of the differences between penetration testing and BAS is that it is done at specific intervals, with the latter providing a constant view of a company’s security posture, making it easier to identify and address issues.

In this aspect, BAS minimises the costs of penetration testing:

Continuous security validation: With BAS up and running all the time, it is possible to constantly identify and fix system problems. This proactive approach helps reduce the number of full-scale penetration tests that are conducted at regular intervals since most of the common problems are fixed in real time.

Streamlined pen testing efforts: In a nutshell, BAS takes care of the daily vulnerability assessments, whereas penetration tests are more effective and directed to the most important and complicated sections of the network. This approach helps to reduce the extent of traditional penetration testing and thus decreases time and costs.

Cost savings through automation: Penetration testing is challenging in that it demands extensive time input as well as specialised skills – this last comes with a high price tag. Some of the tasks usually carried out during penetration tests are also performed by BAS, which means that many of them are automated, enabling organisations to get similar results, while doing it faster. In the long run, BAS automation helps to reduce the costs of frequent penetration testing services.

Faster remediation and validation: Another advantage is that BAS helps verify whether vulnerabilities have been effectively dealt with once identified. This means there is no need for another penetration test to check on the fixes made. This, in turn, decreases the cost and time needed for the penetration test and guarantees that security is always enhanced.

Year-round protection: BAS ensures that a strong and effective security posture is maintained throughout the year, not just during penetration testing cycles. This way, when major vulnerabilities are dealt with during continuous testing, there are no serious findings during the periodic penetration tests. This approach saves on time as well as the cost of remediation and re-assessments.

The perfect partnership

BAS should not be viewed as a replacement for penetration testing, but rather an extension of it. Penetration testing is still very useful in identifying more complex risks and assessing the effectiveness of challenges created by human beings. BAS, however, is better at offering real-time, automatic analysis that does not allow risks to accrue.

This partnership enables the businesses to maximise returns on their security investment. BAS takes care of the day-to-day checkups and makes sure there is no threat at all, while penetration testing focuses on identifying high-risk areas. Altogether, they provide a structured approach to security that is both comprehensive and economical.

Conclusion

It’s wise to integrate BAS into your security strategy if you are a company wishing to strengthen its defences and, at the same time, cut costs.

Businesses leveraging automated solutions - such as BAS - for continuous security validation, while reserving penetration testing for targeted, high-risk scenarios, can reduce costs significantly, while maintaining a robust security posture. This approach guarantees proactive defence without compromising the quality of protection.

BAS is not only a new tool in the security arsenal, but an important step towards greater efficiency and robustness for businesses wanting to remain relevant in a dynamic threat environment. This is where BAS and penetration testing align; both solutions help to strengthen security posture, while guaranteeing that every Rand you spend on security is well spent.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Managed security solutions for organisations of all sizes
Information Security
Cyberattackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
Multiple IoT devices targeted
Information Security Residential Estate (Industry)
Mirai remains one of the top threats to IoT in 2025 due to widespread exploitation of weak login credentials and unpatched vulnerabilities, enabling large-scale botnets for DDoS attacks, data theft and other malicious activities.

Read more...
SABRIC Annual Crime Statistics 2024
News & Events Security Services & Risk Management Residential Estate (Industry)
SABRIC has released its Annual Crime Statistics for 2024, reflecting a significant decline in financial crime losses, but also warning of the growing threat posed by artificial intelligence (AI) in fraud schemes.

Read more...
Local-first data security is South Africa's new digital fortress
Infrastructure Information Security
With many global conversations taking place about data security and privacy, a distinct and powerful message is emerging from South Africa: the critical importance of a 'local first' approach to data security.

Read more...
Sophos launches advisory services to deliver proactive cybersecurity resilience
Information Security News & Events
Sophos has launched a suite of penetration testing and application security services, designed to identify gaps in organisations’ security programs, which is informed by Sophos X-Ops Threat Intelligence and delivered by world-class experts.

Read more...
SA’s private security industry receives multi-million USD investment
News & Events Security Services & Risk Management
South Africa's private security sector has attracted significant international attention, with the world’s largest tactical flashlight manufacturer, Nextorch, announcing a major investment in its local operations, Nextorch Africa.

Read more...
Kaspersky highlights biometric and signature risks
Information Security News & Events
AI has elevated phishing into a highly personalised threat. Large language models enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams.

Read more...
Software security is a team sport
Information Security Infrastructure
Building and maintaining secure software is not a one-team effort; it requires the collective strength and collaboration of security, engineering, and operations teams.

Read more...
View from the trenches
Technews Publishing SMART Security Solutions Editor's Choice Integrated Solutions Security Services & Risk Management Residential Estate (Industry)
There are many great options available to estates for effectively managing their security and operations, but those in the trenches are often limited by body corporate/HOA budget restrictions and misunderstandings.

Read more...
IVA AI Pro Visual Gun Detection
Products & Solutions Surveillance Security Services & Risk Management Residential Estate (Industry)
Bosch has announced the launch of the IVA AI Pro Visual Gun Detection analytics based on deep learning. It is designed for automatic detection and classification of people and brandished firearms.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.