Why Pen Testing Is a Starting Point, Not the Finish Line
Pen testing offers point-in-time insight, but embedded security requires continuous visibility. Learn why lifecycle security beats one-and-done testing.
Larry Pesce
VP of Services
Penetration testing plays a vital role in any product security strategy. It can help uncover vulnerabilities, validate controls, and meet compliance requirements. But for connected device manufacturers, treating pen testing as the end of the security journey is a dangerous mistake.
“Pen testing tells you where you are today—but product security is a moving target. Real security means knowing what’s in your software, validating your assumptions, and maintaining that posture over time.”
Where Pen Testing Falls Short in Embedded Environments
Traditional penetration tests are valuable but limited. Especially in embedded and IoT ecosystems, where firmware is opaque and software supply chains are complex, pen testing often fails to uncover the full picture.
Typical limitations include:
- Point-in-time visibility: Pen tests reflect the state of a product at a specific moment, not how it will evolve post-launch.
- Scope constraints: Outcomes depend heavily on how the test is scoped, what access is provided, and what components are in scope.
- Surface-level coverage: Deeply embedded or statically linked components often go untested.
- Lifecycle blind spots: Pen tests rarely account for post-market changes, OTA updates, or build drift over time.
These gaps are not theoretical. They’re the kinds of weaknesses attackers exploit and the ones regulators are increasingly asking manufacturers to address.
What a Lifecycle-Driven Approach Looks Like
At Finite State, we view pen testing as an important milestone, not the finish line. We help customers move from reactive testing to proactive, scalable security by integrating pen testing into a broader product security lifecycle that includes:
- SBOM Generation and Validation
Know exactly what’s in your firmware—first-party, third-party, and transitive components. - Continuous Vulnerability Analysis
Monitor source and binary artifacts to catch emerging CVEs, licensing risks, and policy violations over time. - Remediation Testing
Validate that applied fixes actually resolve vulnerabilities and don’t introduce new ones. - CI/CD Integration
Automate enforcement and scans within your development pipeline to catch issues earlier. - Regulatory Roadmap Alignment
Map your security posture to frameworks like the EU CRA, FDA 524B, Cyber Trust Mark, and CTIA requirements.
This integrated approach gives you visibility not just into what’s broken, but how to fix it and keep it fixed.
Why It Matters
Pen tests reveal symptoms, not root causes
Without context from binary analysis and SBOM data, you risk solving surface-level problems while deeper risks go unchecked.
Security is a process, not a project
One-time tests don’t account for new code, changing components, or evolving threat intelligence.
Regulators expect continuous security, not one-and-done reports
Requirements like the EU CRA and FDA 524B demand proof of ongoing risk management, not just a test at release.
Customers expect trust not checkboxes
Lifecycle-driven security demonstrates maturity and earns credibility with OEM partners, customers, and auditors.
From Point-in-Time Testing to Continuous Product Security
Pen testing will always be essential. But it’s just one piece of a much larger security puzzle.
Finite State’s platform and services help embedded device teams extend the value of pen testing—closing the loop with continuous validation, real-time insights, and end-to-end supply chain visibility.
Need an embedded pen test? Start here
Larry Pesce
VP of Services
Larry Pesce is VP of Services at Finite State, where he leads product security research and vulnerability assessments across IoT, OT, and healthcare devices. With over 20 years of experience, he’s also a longtime SANS instructor and co-host of Paul’s Security Weekly, known for advancing vulnerability management practices industry-wide.
