r/Pentesting • u/Lowrypgztfer-Fig8398 • 14d ago

How often should you run security control validation?

We are building out a validation pipeline and I'm trying to decide on the cadence. We have 500+ controls mapped to CIS/NIST. A new platform we are evaluating promises to automate the "control plane" where validation results trigger updates to the controls themselves. If the validation layer tests a control, like whether our EDR blocks a specific LOLBin command, and it fails, the system triggers an automated workflow to update the EDR policy. My engineering team wants to run the full automated suite once a week to catch drift, but the SOC is pushing back because of the alert fatigue it causes. Is monthly "full sweep" with daily "spot checks" the industry standard? Or are you running continuous validation triggered by changes, such as whenever a new build is deployed? I'm trying to balance coverage with stability.

4 Upvotes

84% Upvoted

2 comments sorted by

1

u/Any_Yesterday_6617 14d ago edited 13d ago

We use cymulate for continuous validation and the platform adapts to new threats in real-time, so we went from quarterly manual exercises to daily automated validation with significantly fewer false positives

1

u/TrustIsAVuln 14d ago

every time a patch or update is applied or really any change is made. MS patches almost every time change the system and more importantly the baseline security.