INSIGHTS, SECURITY ASSESSMENT
Security assessment or Continuous Offensive Security Testing (COST): which question are you asking.
Both are sold as assessment; a buyer asking for one often needs the other. The difference is the question, not price or depth. Name the question before naming the engagement.
Program or target: two different questions.
A security assessment is a decision tool before it is a technical exercise: does each control exist, does it work, and can you prove it worked on a date?
Continuous Offensive Security Testing (COST) is narrower and deeper: recurring cycles against named targets, each under a written test plan, worked as an attacker would, and nothing off the plan.
| Dimension | Security assessment | COST |
|---|---|---|
| The question | Is the program working, and what belongs first. | Can this be broken into, and how far does it go. |
| The shape | Breadth across the review areas, governance and vendors included. | Depth against named targets, one agreed window per cycle. |
| The output | A ranked roadmap leadership can approve. | A proven path, and the evidence it worked. |
| Who reads it first | The board, the audit committee, the examiner. | The engineer who fixes it, then the executive who funds the fix. |
| What it cannot tell you | Whether a specific weakness is exploitable today. | Whether the areas outside the target list are in order. |
Neither replaces the other or proves an organization secure. Each report must say what was examined, what was not and how findings were confirmed.
What must you know at the end, and who will act?
They settle most cases, because a board, an examiner and an engineer need different evidence.
| Situation | Engagement |
|---|---|
| An examination is on the calendar | Assessment, Full scope, for breadth |
| A counterparty asked who performed your last independent test | The wording decides |
| A finding named IT governance or vendor management | Assessment: a view of the program |
| A rule sets a testing cadence that reaches you | Test |
| A new platform, acquisition or rebuild goes live | Test, scoped to what changed |
| The board asked whether the controls work | Assessment; the roadmap is the board paper |
Where a contract says penetration testing by a qualified and independent third party, as the Freddie Mac Guide does, it means a test, on a defined scope, by someone outside your team.
The Safeguards Rule at 16 CFR 314.4(d)(2), where the consumer count does not remove it, and 23 NYCRR Part 500 for a Covered Entity that is not exempt, each expect testing on a schedule.
Usually, assessment first.
The assessment's roadmap names the test worth buying, and why. Testing first risks a clean report on a guessed scope, with the examiner's area unread. A test that succeeds in an afternoon has found a program problem; the assessment makes it a decision.
Where a contract or rule names the test, it comes first: the date and wording are fixed. The assessment still asks whether findings become fixes.
Do not buy the label.
A scan with generic recommendations is sold as an assessment, and the same scan run once as a penetration test. Neither is either. A proposal that does not state all four is not ready to sign:
- The question, in one sentence, in the seller's words.
- The scope as a list, with exclusions: review areas, or targets, knowledge level and window.
- The method: access needed, who does the work, what happens on a critical find.
- The named deliverables, and whether one round of verification of remediated findings is in the fee.
Both engagements here publish all four, one round of verification included.
What this article claims.
This article is a way of choosing between two engagements. It is not a scope recommendation for any institution, and it is not legal advice. No report from this firm, from either engagement, is represented as proof that an environment is secure or compliant.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
Start at the Security Assessment for the program, Offensive Security for a named target. Bring counterparty wording, since it decides, and your date; the first reply names the engagement and whether we can meet it.