Global Big Tech companies are already moving with continuous vulnerability validation set as their default standard. 

Since 2014, Google has run a dedicated research team called Project Zero, dedicating 100% of its researchers' time to discovering vulnerabilities and structurally improving security. In 2024 alone, Google paid nearly $12 million in rewards to over 600 researchers worldwide through its vulnerability reward programs. It also individually managed an AI-related bug bounty, receiving over 150 submissions. 

Microsoft has operated its AI Red Team since 2018. In 2025, it distributed $17 million through its bug bounty program, bolstering vulnerability hunting alongside external researchers. Moreover, via "Zero Day Quest," it concentrated on discovering high-risk vulnerabilities in cloud and AI. In its Secure Future Initiative (SFI) progress report, Microsoft revealed that it preemptively discovered and mitigated 180 new vulnerabilities through this process.

Coupled with this, AI is further accelerating the speed of cyberattacks. 

In its August 2025 Threat Intelligence Report, Anthropic disclosed that Claude Code has been used to automate reconnaissance, credential harvesting, and network penetration, and was exploited in data extortion schemes targeting various international organizations. 

The report features cases where low-skilled attackers leverages AI to develop and sell ransomware. Additionally, in its January 2026 follow-up assessment, it explained that current Claude models have improved to a level where they can successfully launch multi-stage attacks across dozens of networks using only standard open-source tools. 

AI is not a magic wand creating completely new hacks; it acts as an accelerator that lowers the technical barrier and speeds up the preparation and execution of attacks.

In this environment, we must shift our defensive strategy. Continuous penetration testing does not mean shaking up every system every day. 

First, we must always maintain an up-to-date understanding of high-risk assets, such as externally exposed systems, key data, authentication mechanisms, and partner integration boundaries. Over this, we must layer periodic penetration tests, blind testing, red teaming, and bug bounties. 

The most crucial final step is retesting after remediation. It shouldn't be a test that ends upon finding the issues; it must be a loop of finding, fixing, and verifying again.

Of course, in reality, not every company can build an in-house dedicated red team. To house an organization that continuously designs attack scenarios, hunts vulnerabilities, and executes re-verification like Google or Microsoft requires headcount, budget, and operational experience. Particularly for companies with small security teams, mid-sized enterprises, SMEs, and agile service operators, building such a system independently is extremely difficult.

Even so, continuous validation cannot be neglected. In these cases, a realistic alternative is leveraging external experts and Penetration Testing as a Service (PTaaS). Continuous penetration testing is completed neither by humans alone nor by tools alone.

caption - Combining Automation Tools with Human Experts (Created by Gemini)

Automated tools excel at looking broadly and checking frequently. They can quickly scan asset changes, external exposure states, basic vulnerabilities, and areas requiring repetitive verification. On the other hand, human experts excel at digging deep. They look through the eyes of an attacker to find bypass paths, chain multiple weaknesses to verify actual exploitability, and identify issues requiring context—such as business logic flaws or privilege abuse. To put it simply, tools look broad, while experts look deep. For a continuous validation system to function properly, these two must work hand in hand.

This involves conducting penetration tests with the help of experts whenever necessary, and ensuring that results are not just left as a single report but lead to repetitive checks and re-verifications. Even companies unable to maintain a large internal red team can utilize external expertise to build an operational model that mimics a continuous validation system. 

What matters is not the structure of your organization, but the continuity of validation. If internal capabilities are lacking, leveraging experts and services to keep the check-fix-verify loop running uninterrupted is a more realistic and effective solution.