gshc2020.com

A penetration test is a simulated cyberattack, run by ethical hackers, that shows where a company’s real-world defenses would actually fail. And although a pen test can inspire a degree of confidence in safety, data breaches may still occur and new vulnerabilities are introduced daily.

Vulnerability exploitation is behind some 31% of breaches. Most likely, this figure will increase as attackers’ malicious use of AI grows to exploit weaknesses before defenders can patch them. Pen testing remains one of the most effective forms of mitigation, but only if testing is scoped to reflect how the business actually operates.

Scope For Business Impact, Not Just IT Assets

Many organizations think too narrowly when scoping a pen test. It either revolves around their website, a business-critical application or a specific system compliance that needs to be checked. Unfortunately for them, attackers go after whatever is connected to the target. This may include a vendor’s API, a third-party integration or a tool a department deployed without IT authorization.​

Scoping a pen test shouldn’t begin with the question, “What systems do we own?” The right question should be, “What would actually hurt the business if a system failed?” This ‘hurt’ can take the form of data exfiltration, lost revenue, regulatory penalties and broken customer trust. The kind of information leadership must worry about.​

Four Questions To Define Your Scope​

Effective penetration test scoping requires addressing four critical questions regarding asset location, data prioritization, compliance scope and historical threat patterns. These key areas, including security frameworks and industry history, ensure that the assessment focuses on the most critical vulnerabilities.​

1. Where Do Assets Reside?​

Your organization may have a larger IT footprint than you realize. This can include in-house servers, cloud workloads and third-party tools that increase in number as the business grows. Data breaches tend to start in a corner of the IT ecosystem that hasn’t been well scoped.​

2. What Data Matters Most?

Data has an importance hierarchy: Financial records, intellectual property and personal health information (PHI) carry more risk than routine operational data. This essentially means that not every system demands the same level of scrutiny. If you don’t prioritize scrutiny, you might have to battle a lot of white noise that has the potential to overshadow the findings that matter most.​

3. Is Compliance The Beginning Or The End?

When it comes to scoping systems for weaknesses, compliance and security frameworks like PCI DSS, HIPAA and GLBA represent a baseline (not the ceiling). For instance, a retailer can pass a PCI DSS audit by locking down the POS system and still leave a loyalty-rewards app storing the same credit card data untested, simply because the audit never considered it.

4. What Does History Show?

According to the FBI’s Internet Crime Complaint Center, over $20 billion in losses were reported last year, with healthcare ranking as the most targeted critical infrastructure sector for ransomware attacks, followed by manufacturing, financial services and IT. This information should be considered when scoping. Supply chain dependencies, operational technology and recovery time for production systems, among other things, should fall within the scope.

Aligning The Test To The Risk

The right scope ensures the right mix of pen testing. External testing looks at what is exposed to the internet, including firewalls, Wi-Fi, web apps and APIs. Internal testing assumes the attacker is inside the network and measures how far an attacker can move laterally through the system to gain administrative control or escalate access privileges. Considering the growing cloud infrastructure and the shared responsibility model with cloud providers, cloud assessments will check a configuration against industry standards such as CIS benchmarks. Wireless testing takes a look across wireless networks, catching weak encryption and rogue access points.

Software carries its own exposure, too. Application testing digs into custom or third-party code for injection flaws, broken authentication or excessive access. With AI-tool sprawl, AI and agent testing has emerged as the newest category, probing how these systems handle manipulation, unauthorized data access and prompt injection. Tying it together, red or purple team exercises simulate a sustained, realistic attack, testing not just technical defenses, but how a security team actually detects and responds to incidents in real time.

Testing Is A Strategic Decision

The objective behind pen testing should ensure that leadership uncovers its high-priority cybersecurity risks. Test what will genuinely disrupt and harm the business and prioritize. This is both a business and a technical decision. If your pen test proves negative but the reasons outlined in the report findings are not clear, your instinct should trigger suspicion. Check to determine what was excluded from the scope. This is the area where risk might have been sitting undetected all along.

In Summary

Penetration testing is most effective when it is customized/tailored to reflect how the business actually operates and where the greatest consequences of failure lie. If the scope is too narrow, the results may offer reassurance without revealing the exposures that matter most. In the end, the value of a pen test is not simply that it was conducted, but that it was designed to uncover risks that leadership can’t afford to miss.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

One of the best movies of 2023, however, takes a very different approach: What if the creature loved being alive? What if she greeted every forbidden desire and painful revelation with curiosity rather than shame? And what if, instead of turning against the scientist who created her, she loved the flawed man for giving her the opportunity to experience it all?

This novel take on Mary Shelley’s formula is central to Poor Things, Yorgos Lanthimos’ unforgettable sci-fi fantasy that’s leaving Netflix on Sept. 7. The world of Poor Things resembles a surrealist painting trapped inside an elaborate snow globe, with strange cities with impossible horizons and a dreamy steampunk aesthetic. But it's the very human tale playing out against those stunning backdrops that makes Poor Things an instant classic in the pantheon of Frankenstein stories.

Bella Baxter, played by Emma Stone in the boldest performance of her career, is brought to life by scientist Godwin Baxter (Willem Dafoe). He is at once Frankenstein himself and the monster, riddled with scars and spare body parts attached to machinery that leave him burping curious bubbles. Though she has an adult woman’s body, Bella begins the movie with the developing mind of a child. This gives Stone the opportunity to portray a person who must discover movement, language, food, pleasure, cruelty, poverty, philosophy, and morality from a blank slate. What does that mean when the world still sees her as a beautiful young woman?

Stone makes Bella’s development feel astonishingly organic. Everything from her gait and posture to her vocabulary and facial expressions gradually mature over the course of the movie’s 141-minute runtime. Yet she never feels like a series of disconnected characters. The self-actualized woman at the end, who moves through the world with confidence, still feels connected to the titular “poor thing” who smashes plates because she delights in the crashing sounds they make minutes into the film.

Emma Stone turns a male fantasy into a force of nature

It’s easy to imagine a version of this performance that feels like an Oscar-baity stunt, but Stone is clearly possessed by Bella’s appetite for life and, through her, discovers the entire spectrum of human experience at an accelerated rate. That process becomes deeply uncomfortable once the lawyer Duncan Wedderburn (Mark Ruffalo) sparks Bella’s sexual curiosity and convinces her to run away with him. Because she’s really just a child who doesn’t understand the nature of sexual desire, she does not recognize the perverse, exploitative arrangement she enters. Duncan assumes her naïveté will make her easy to control. He could not be more wrong.

Poor Things deliberately invokes the troubling “born sexy yesterday” trope seen in stories like The Fifth Element, in which an adult woman’s innocence makes her desirable and emotionally dependent on a more experienced man. But Poor Things is more interested in deconstructing that fantasy and punishing the men who fetishize it. For Bella, innocence does not mean obedience. She has the curiosity of a child but the body, and therefore agency, of a woman. That strange collision leaves her free from the shame, jealousy, and romantic conventions Duncan needs to manipulate her.

Ruffalo is astonishingly funny as Duncan, a creep who thinks he’s the luckiest man in the world because he alone has conquered a Lolita in a woman’s body. Yet he quickly discovers he’s instead unleashed an insatiably curious force of nature into the wider world. The more Bella experiences, the faster she develops — and the less important he becomes. Duncan eventually grows so desperate and pathetic that he starts throwing tantrums that will leave you cackling.

At first, Bella has desire but little to no empathy. She knows what she wants but cannot yet comprehend the effects her choices have on other people. Her freedom can feel selfish and sometimes cruel. This same emotional disconnect is what renders her functionally immune to the exploitation she experiences, at least in terms of the associated trauma you’d expect — but it remains exploitation nonetheless. Poor Things refuses to let that define her as a character. The men around Bella repeatedly attempt to tell her what her body, appetites, and experiences mean. She refuses to surrender that authority and gradually grows into a fully actualized human being with total independence. How she gets there delivers plenty of surprises along the way with a deeply satisfying conclusion.

It’s impossible to measure Bella’s behavior against any societal expectations, whether in our world or that of Poor Things. She is an impossible thought experiment: a new consciousness developing at a rapid rate inside a mature body. That premise is frequently disturbing, and that discomfort never disappears. But what makes Poor Things so interesting is that our discomfort is used to separate innocence from obedience and sexual experience from shame in a way that makes us wonder why we are socialized to draw connections between these things to begin with. By the end, Bella is not the woman whose body Godwin recovered, nor the child whose mind he placed inside it. She has become a wholly new person.

In addition to the powerful performances and profound message, the most memorable thing about Poor Things is its production design. The meticulous, colorful sets and costumes evoke Wes Anderson, but where Anderson so often confines his characters to limited spaces and a limited range of motion, Lanthimos surrenders constraint and manners for the sake of giving his characters absolute freedom (especially Bella). Poor Things and the characters in it are less mannered and more vivid. Even supposed villains like Duncan — and Godwin, to a lesser extent — reveal flashes of tenderness and humanity. The world resembles a dazzling dollhouse, but its inhabitants are as messy and dynamic as you or me.

Ultimately, Poor Things takes one of science fiction’s oldest tales of body horror and romantic tragedy and transforms it into something even stranger, sexier, and more triumphant: a resurrected woman ravenous for everything life has to offer — even when others might deem her pursuits as unnatural and disturbing.

Poor Things leaves Netflix on Sept. 7, 2026. %!s()

By that point, we’ve come to know the handful of independent reporters — most of them women accused of being “foreign agents” by Putin’s government — whom Loktev documented during the tense months leading up to the war, showing how they held fast to their beliefs while their country began to crumble around them.

My Undesirable Friends: Part II — Exile

The Bottom Line

Life — and journalism — during wartime.

Venue: Venice Film Festival (Out of Competition)
Cast: Anna Nemzer, Valeria Ratnikova, Ksenia Mironova, Elena Kostyucheko, Yana Kuchina, Irina Dolinina, Alesya Marokhovskaya, Peter Ruzavin, Nataliya Gumenyuk, Sonya Groysman
Director, cinematographer: Julia Loktev

5 hours 56 minutes

In the second half of this epic study of persecution and resistance, we watch these courageous, resourceful young journos deal with forced exile, scattering across several countries and continents as the Russian state continues to pursue them for bogus offenses like spreading “fake news.” Given what they already dealt with back home, it’s no surprise they exhibit a fair amount of sangfroid and journalistic integrity as they wheel their carry-on luggage from one airport or Airbnb to another, trying to find a place to live and especially to work, which they continue to do while the conflict rages on.

Such persistence doesn’t, however, shield them from a deep sense of loss, loneliness, anxiety and especially guilt as the citizens of an oppressive, war-crime-committing superpower, even if they’re also being oppressed themselves. One of them sums up that sentiment early on by quoting a friend, who quips: “It’s like 1941 and you’re simultaneously the German and the Jew.” That Kafkaesque sense of never being fully safe, of never being at peace with oneself, hovers over much of My Undesirable Friends: Part II — Exile, though it also never stops these women from getting the truth out.

Divided into five chapters that stretch from the invasion until the spring of 2026, the doc stays glued to its reporters through thick and thin — clearly a logistical feat given how they constantly change locations after visas are granted or denied, newsrooms opened or shuttered, and the world as they once knew it is transformed into a continual state of precarity. “It’s like my life is totally in someone else’s hands,” comments Valeria Ratnikova, aka Lera, who’s only 23 when we first see her in a taxi in Istanbul alongside Ksenia Mironova, aka Ksysusha. (The loving Russian diminutives all the characters give each other underscore their sense of solidarity.)

Lera’s trajectory, which takes her from Russia to Turkey to Latvia and finally to the Netherlands, serves as something of a throughline in an ensemble piece that has nearly a dozen protagonists. As the youngest anchorwoman at the independent news station TV Rain, which shuts down in Moscow as soon as the war breaks out, Lera finds herself on the run along with her hardworking colleagues, all of whom are forced to pack their bags (or more like one bag) and rush to the airport before Putin tosses them in jail.

Trying to find their footing abroad while reporting on what’s happening in Ukraine, including the many atrocities committed in the early months of the conflict, the TV Rain team faces untold challenges to get the news out. Not only do they continue to be persecuted from afar — Lera will be convicted in absentia to seven and a half years in prison for working for an “undesirable organization” — but the channel nearly folds when a newscaster uses the term “our army” when referring to the war crimes committed by the Russian military, causing a scandal in their host country of Latvia and, eventually, the suspension of their broadcasting license.

The catch-22 situation the reporters all find themselves in — either stay in Russia and face prison, or flee abroad and face both personal exile and anti-Russian prejudice — is something they accept as par for the course, well aware that those dying in Ukraine do not have the luxury of that option. “Like it or not, the war is being waged in our name too,” one of them comments, taking responsibility as both a Russian citizen and an independent journalist who refuses to bow down to the Kremlin’s demands.

The reporter Peter Ruzavin takes his convictions a step further, joining his girlfriend, Ukrainian author and journalist Nataliya Gumenyuk (founder of the Public Interest Journalism Lab), in Kyiv. At first, he files articles and conducts a podcast about the frontlines, capturing the war from the inside. But at some point, he decides to sign up for the army himself (“It makes sense to fight for it,” he explains), working as a drone operator and eventually getting wounded, for which he receives a medal of honor.  

Loktev, who shot the entire 12-hour doc herself, turns each reporter into the character of a real-life series unfolding before our eyes as the years go by and the war inevitably drags on. Framing her subjects in medium close-ups, she creates an intimacy that goes beyond the international crises and political upheavals to focus on the human costs of an unending conflict. The journos may all be hardworking and heroic; they’re also normal people trying to conduct their lives amid the chaos.

These obstacles are clearly faced by TV Rain reporter Anna Nemzer — a close friend of the director and the principal subject of part one — who’s forced to travel from city to city with her husband and young daughter in tow, until they finally settle down in New York. You can see the sheer exhaustion and frustration Anna faces as she tries to both do her job and be a good mother, all the while fleeing from one place to the next. If the experience allows her to focus on the essential (“Who do I love?” “Who am I?” “What is important to me?” she asks aloud), it winds up taking a toll on both Anna and her family.

Anna’s story is among several that Loktev and co-editor Michael Taylor weave together in chronological fashion, showing how each character evolves while facing one obstacle after another. These include the death of loved ones from afar, the risk of assassination by Putin’s minions in whatever country they’re living in, the impossibility of knowing where their next home or job will be, and the anger they face from both Russians (including many of their parents) and Ukrainians who see them as the enemy.

By the time My Undesirable Friends: Part II winds down, just a few months prior to the film’s premiere in Venice, the war seems to have no end in sight, leaving all the lives we’ve been watching permanently disrupted. And yet the reporters continue to press on, with one late segment featuring Ksysusha on location in Washington, D.C., interviewing Trump supporters on the day of his second inauguration. “I’m now in America and the same things are happening here,” she remarks, highlighting how none of us is truly safe from totalitarian oppression, wherever we wind up living. Or, as Lera concludes after being convicted and rendered a fugitive from justice in her homeland, when “the truth is a lie, and a lie is the truth,” some of us need to be brave enough to speak about it.    %!s()