With security threats to organizations only increasing and privacy legislation continuing to evolve, penetration testing remains a critical tool for protecting sensitive data.

And as endpoints multiply thanks to an increase in remote work, there’s no airtight network perimeter, which makes it all the more difficult for organizations to safeguard sensitive data. For it to be effective, penetration testing must be done properly, and it’s more than evaluating network security. It must be viewed holistically as part of your broader information security program.

Most of all, penetration testing should be more than a box that gets ticked once or twice a year to meet compliance obligations, and it should tap the outside expertise of partner that can put your  people, processes and technology through their paces.

Endpoints raise risk

With an exceptionally high number of employees working remotely, the threats posed by endpoints to sensitive data must not be underestimated, whether it’s smartphones, laptops and IoT devices, many of which reside outside the main firewall. One of the most common mistakes is assuming that spending a lot of money on software and hardware will automatically protect sensitive data, but you must also account for human behavior.

Having newer hardware with the latest operating system can mitigate risk, but even the latest greatest fleet of workstations will bring with them their own built-in vulnerabilities. These must be identified and managed based on how they are deployed and the cybersecurity awareness of the end user. This is especially true as more employees work from home—there are many ways to access data and applications that don’t involve hacking a network. All it takes is one poorly configured web portal to open access a domain to threat actors so they can take complete control infrastructure.

These same threat actors take advantage of human behavior as users fall for convincing phishing emails. They also exploit vulnerabilities in software and hardware that are often the result of a convenient feature by using botnets to scan for them even as most organizations are oblivious that they’re even at risk.

And if you think you’re not worth hacking because you’re a small organization, think again. Hackers see you as easy targets because they know you’re less likely to have the security technology, resources and best practices that larger organizations may have. The good news is that as a smaller organization you’re more nimble and agile so you can adapt and more quickly benefit from penetration testing.

Testing should be proactive

Not all penetration tests are equal, and ideally, they should be done before a breach, not after you’ve lost sensitive data.

Rather, you should identify milestones that would necessitate a test of your network security. A trigger might be a workstation refresh or major operating system update as they can often be configured in such a way that unwittingly opens door that can be entered by threat actors. And while compliance obligations should inspire penetration testing, it should be more often than an annual exercise to please regulatory bodies.

Because effective penetration testing takes a great deal of skill and expertise and can take time away from regular IT operations, tapping the expertise of an experienced service provider who can poke holes in your security and will find vulnerabilities goes a long way to protecting sensitive data. They’re up to speed on the misconfigurations and evolving threats that might let someone sneak in, as well as the common mistakes made when configuring enterprise networks and remote worker access.

If you want to truly protect sensitive data, take the results of any penetration testing seriously, even if it might reflect badly on your efforts today. You’ll be better off the in long run. Protecting sensitive data is an exercise in continuous learning that mitigates risk, and frequent penetration testing is a contributor to competitive advantage as it enables you to build trust and credibility with your customers while maintaining compliance.

Sanjeev Spolia is CEO of Supra ITS