Beyond traditional penetration testing

October marks Cybersecurity Awareness Month, a timely reminder for organisations to examine how resilient they are against today’s evolving cyber threats. Unfortunately, many businesses still treat cybersecurity as a concern only after a costly security breach - incidents which, in many cases, could have been prevented through proactive measures. Time and again, we have seen how severe the consequences can be, from business disruption to reputational damage and even regulatory fines.

Moving from a point-in-time assessment to real-world simulations

A typical penetration test provides a snapshot of vulnerabilities at a specific point in time. It is a basic yet practical form of cybersecurity testing that takes a hands-on approach compared to tabletop exercises or traditional audits. Yet in today’s threat landscape, pen testing alone offers limited visibility into an organisation’s core security risks, which often extend beyond software and system weaknesses.

This is where advanced security testing comes in. The most popular form is the red team assessment (a term originating from military exercises), which unfolds over several weeks and in some cases, up to three months. This contrasts sharply with a pen test, which is typically limited to a week or two. Red team exercises require greater preparation and coordination but deliver deeper insights into how a business could be breached by cybercriminals or other advanced threat actors.

One formalised approach for conducting a red team assessment is Threat-Led Penetration Testing (TLPT). With the introduction of the Digital Operational Resilience Act (DORA) earlier this year, financial institutions of systemic significance must undergo a TLPT once every three years. A unique characteristic of TLPT is the inclusion of threat intelligence gathering to identify cyber threat scenarios applicable to the institution – considering active threat actors, deployed tactics and techniques, the geopolitical climate, and other regional factors.

Understanding the value

Technology alone cannot prevent every attack. According to the World Economic Forum’s Global Cybersecurity Outlook 2025, 42% of organisations experienced phishing or social engineering incidents last year. These attacks exploit human psychology, proving that even the best defences can be undermined by a single click. Advanced testing reflects this reality, providing leaders with a true measure of preparedness and resilience.

The main objective of a red team assessment is to measure how effectively an organisation can detect, respond, and recover under real pressure by simulating a realistic cyber threat scenario. It helps technology and business leaders answer critical questions such as: Would our business survive a ransomware attack or the theft of sensitive data? How resilient are we if we experience a major cyber incident? The outcome is ultimately a bird’s-eye view of an organisation’s security posture across people, processes, and technology, reinforcing the notion that cybersecurity is not (just) a tech problem.

Who should consider advanced testing?

Any organisation benefits from penetration testing, often carried out on annual basis or when significant changes take place. Advanced security testing, however, is most relevant for regulated and high-maturity sectors such as finance, iGaming, energy, manufacturing, healthcare, and other operators of critical infrastructure. These sectors face unique and sophisticated threats that require a more rigorous and comprehensive approach for evaluating their security posture, especially since they typically deal with large attack surfaces, complex web and cloud applications, and usually have a high dependency on digital supply chains.

Advanced security testing is also increasingly becoming an important element in regulatory frameworks and standards such as DORA, NIS2, ISO 27001, and other sector-specific mandates, as it demonstrates proactive cyber risk management.  This shift reflects a growing recognition that traditional, checklist-based approaches are no longer sufficient to address today’s cyber threat landscape where cyber criminals and state-sponsored hacking groups are continuously reinventing their modus operandi.

Our investment in this space

At PwC Digital Services, we have extensive experience and capabilities in delivering advanced cybersecurity testing across various sectors and industries. Over the years, we have heavily invested in a team of experts who understand the technical intricacies, regulatory context, and business challenges that local organisations face while navigating the complex cyber landscape.

Ultimately, advanced security testing is not about passing or failing. It is about building confidence in the boardroom, with regulators, and with customers that the business can withstand, adapt, and recover from the threats it will inevitably face. As Malta’s digital economy continues expanding at a rapid pace, prioritising cybersecurity is essential for protecting operations, customers, and sustained growth.