How three financial and insurance organizations are putting continuous exposure management into practice
Passing an audit and surviving an attack are two different tests.
An audit can establish whether an organization meets defined requirements, including requirements for control effectiveness. But passing does not mean every assumption about access, segmentation, and remediation has been tested against what an attacker could actually do.
A development environment may be considered isolated. A pentest may satisfy a banking requirement. A remediation ticket may be closed. Each provides some assurance. Security teams still need evidence that the isolation holds, the testing covers meaningful exposure, and the fix closes the demonstrated attack path.
Three financial and insurance organizations illustrate how teams are operationalizing continuous exposure management: challenging assumptions about controls, expanding testing coverage, and repeatedly validating exposure and verifying remediation as environments change.
A Large Insurer: The Development Environment Wasn’t Isolated
A large U.S. insurer had been running monthly NodeZero® pentests, but its development environment remained outside the testing scope. Developers considered it isolated and low risk.
When the team finally tested Dev, that assumption broke down.
NodeZero uncovered 266 cracked passwords, including 146 accounts sharing the same password. It also identified overprivileged service accounts, compromised backup accounts, and an unpatched ActiveMQ service.
The most consequential finding was the path into production. NodeZero exploited the ActiveMQ service and deployed a remote access tool, which it used to compromise a service account with Domain Admin privileges in the production domain. That account enabled the pivot from Dev into Prod.
Executive credentials were also cracked and confirmed valid, but they were not the credentials used for that pivot. The distinction matters: the production compromise followed a specific, demonstrated chain.
The security team paused its review with Horizon3’s Customer Success team to bring Compliance into the discussion. The organization subsequently overhauled password policies, restricted privileged accounts, and expanded collaboration between security and development teams to validate weaknesses and test fixes.
The lesson reaches beyond password hygiene. An environment excluded from testing can undermine confidence in the environments that are tested. The team believed Dev was isolated. Testing proved that a compromised service account could provide a path into production.
A Global Payments Provider: Required Testing Left Blind Spots
The payments provider faced a problem of coverage.
Its banking partners required at least two pentests annually, and the organization complied. But engagements examined limited portions of a large, distributed environment. Reports varied, and the team lacked a consistent view of what remained untested.
One security leader described the experience: “Pentesters hit the targets and walked away. They told me one or two issues, but never the full picture.”
The first NodeZero run uncovered default passwords on infrastructure devices, exposed ESXi management ports, and misconfigured systems across global offices. Previous pentests had not reported those issues. In one case, a single weak credential enabled access to nearly 300,000 files in approximately two hours.
The organization adopted quarterly NodeZero testing across more than 50 networks, reporting that it tested every IP within its testing scope. It also retained one required annual vendor-led manual pentest.
Banking partners and auditors accepted all four quarterly reports, supported by consistent methodology, broader coverage, and proof of remediation. The team used 1-Click Verify to confirm fixes to critical weaknesses. Improved cyber hygiene also contributed to a reported $500,000 reduction in cyber insurance costs in one year.
Meeting the testing requirement had not given this organization sufficient visibility. Expanding coverage exposed weaknesses that mattered, while verification gave the team evidence that corrective actions worked. That made the results useful to infrastructure teams, banking partners, auditors, and financial leadership.
A Financial and Insurance Organization: Annual Evidence Aged Too Quickly
The third organization faced a timing problem.
Acquisitions expanded its attack surface. Cloud usage increased alongside legacy infrastructure. Outsourced operations complicated ownership of applications and access. The environment changed throughout the year, while security validation relied mainly on an annual third-party pentest and subsequent retest.
Moving to weekly validation revealed exposure that the annual reporting cycle had not captured.
Testing identified 39 distinct attack paths involving one AWS read-only credential. NodeZero demonstrated full AWS account compromise in under 10 minutes and confirmed access to more than 100,000 sensitive files through existing permissions.
The evidence changed remediation conversations. As the organization’s Security Engineer explained, showing an attack path with system details and proof “gets rid of the debate. Even if they don’t understand the technology, they understand that it’s real.”
The team established repeatable remediation workflows and reduced mean time to remediate from months to days. In one instance, identification, patching, and verification of a critical vulnerability were completed within hours.
Frequent testing gave the team more opportunities to discover exposure while the findings were current. Clear evidence helped establish ownership and justify action. Retesting then confirmed whether remediation changed what an attacker could achieve.
Build Assurance You Can Test
Operationalizing continuous exposure management means making this work repeatable: discover exposure, validate exploitability, prioritize by impact, remediate, verify fixes, and repeat as the environment changes. These stories show how teams are putting that discipline into practice.
The insurer challenged an assumption about isolation. The payments provider expanded coverage. The financial and insurance organization shortened the interval between assessments. Across all three, NodeZero connected technical weaknesses to demonstrated consequences and helped teams act on the evidence.
That connection is essential. Vulnerable does not equal exploitable. Exploitable does not equal impact. Validation establishes what attackers can exploit and follows the path to what they could achieve. Verification establishes whether remediation eliminated the demonstrated exposure.
Alongside your audit requirements, ask:
- Which weaknesses can an attacker exploit in our environment today?
- What systems, privileges, and data could those weaknesses put within reach?
- After remediation, can we prove that the demonstrated attack paths are closed?
Those answers help teams direct limited resources toward meaningful risk reduction and explain progress in terms the business understands.
Audit readiness supports compliance. Attack readiness requires repeated testing to expose exploitable paths, guide remediation, and verify that fixes worked.
Join our November 17 webinar, Why Continuous Exposure Management Matters for Financial Services, to learn how teams prioritize exploitable exposure and verify measurable risk reduction. Save your seat.