There's a version of this conversation that happens after an incident. After a breach. After data has been exfiltrated, or systems have been locked down by ransomware, or a client calls asking why their data appeared somewhere it shouldn't.

That conversation is expensive. Remediation is expensive. Reputational damage is expensive. Regulatory exposure (especially under POPIA) can be very expensive.

A penetration test, run proactively, finds the same problems before they become incidents. It's the difference between fixing a lock and explaining to your clients why their data is gone.

We've seen it go both ways. Businesses that test regularly catch things early and fix them quietly. Businesses that don't, often find out the hard way — and at the worst possible time.

The typical approach looks something like this: open the Microsoft Defender portal, see a list of recommendations, pick the ones worth the most points or that seem easiest, and start implementing.

Three months later, your score has barely moved. Or it moved briefly and then dropped back down. Or you've spent weeks on improvements that broke critical workflows and had to be rolled back.

The problem isn't lack of effort. It's lack of strategy.

Effective Secure Score improvement requires understanding three things most teams skip:

Get any of these wrong and you'll spend more time fixing problems than you saved by implementing the recommendation.

This pattern repeats across every recommendation in your Secure Score. What looks like a configuration change on the surface requires strategic thinking about business impact, technical dependencies, and change management.

IT teams often start with "quick wins"—recommendations that promise high point values with supposedly minimal effort.

The problem is that "quick" depends entirely on your environment's current state and complexity. Blocking legacy authentication might take 15 minutes in one organization and require weeks of application modernization in another.

More importantly, chasing points without understanding impact leads to a dangerous pattern: implementing changes that raise your score but don't actually improve your security posture in meaningful ways for your specific risk profile.

The organizations that successfully improve their Secure Score don't focus on quick wins first. They focus on right wins—improvements that align with their actual threat landscape and business priorities, regardless of point value.

Join our security analyst, Kyle Farr, on 10th of February 2026 for a live demonstration of strategic Secure Score improvement:

• Current state analysis - How to assess your score breakdown and identify what actually matters for your risk profile (not just point values)
• Prioritization framework - The decision criteria for determining which recommendations to tackle first based on business impact and technical dependencies
• Live implementation walkthrough - Watch a real security control get configured with proper testing and rollback planning
• Monitoring and sustainability - Building the processes that catch drift before it degrades your security posture
• Q&A for your specific challenges - Get answers about your environment's blockers and constraints

"We've been able to pass cybersecurity compliance of 3 large enterprises (and counting) which the pen test was a fundamental part of,"Jade reports.

Three major enterprise clients were onboarded, with the penetration test playing a fundamental role in passing their cybersecurity compliance requirements.

Regulatory Compliance Formal certification through penetration testing addresses regulatory requirements for operating in certain industries or serving enterprise clients.

Enterprise Requirements Enterprise deals often require security compliance and proper certification before contracts can be finalized.

Sales Documentation Having security certification ready provides documentation that enterprise procurement processes require.

Operational Confidence Comprehensive testing validates existing security measures and confirms platform safety.

Removing Uncertainty Proper security validation eliminates uncertainty about platform safety, allowing teams to focus on growth.

Lelapa AI's approach to security testing and certification addressed regulatory compliance requirements and supported their enterprise client onboarding.

Three enterprise clients onboarded. Certification obtained. Regulatory requirements met.

The two-week engagement provided the certification that was a fundamental part of passing cybersecurity compliance for three large enterprises.

For technology companies serving enterprise clients: security validation and certification can address regulatory requirements and support enterprise sales processes.

Lelapa AI continues to grow across African markets, serving enterprise clients with validated security and regulatory compliance.

We're grateful to Jade Abbott and the Lelapa AI team for taking the time to share their experience and insights for this case study.

MOVEit Transfer (2023): In May 2023, the CLOP ransomware gang exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software's MOVEit Transfer application. By the end of 2023, the attack had compromised more than 2,700 organizations and exposed approximately 93.3 million personal records, with total damages estimated at $12.15 billion. High-profile victims included British Airways, the BBC, Shell, the U.S. Department of Energy, and numerous universities. This breach highlighted the critical importance of rapid vulnerability patching and the devastating consequences of zero-day exploits.

AVTECH IP Cameras (2024): In August 2024, security researchers discovered an unpatched vulnerability in AVTECH IP cameras used in critical infrastructure was being exploited to spread Mirai malware, despite the vulnerability being known since 2019. This five-year delay in addressing a known vulnerability put essential services at risk.

Office of the Comptroller of the Currency (2025): In early 2025, the U.S. OCC identified suspicious interactions between a system administrative account and internal user mailboxes—activity that had gone undetected for months, raising concerns about the agency's visibility into its systems and the effectiveness of its logging practices. This breach at a federal financial regulator highlighted how even government agencies struggle with monitoring gaps.

AT&T Breach (2022-2024): AT&T confirmed a significant data breach involving unauthorized access to its Snowflake cloud storage environment. The breach occurred between May 1, 2022, and October 31, 2022, but wasn't detected until April 2024—a detection delay of nearly two years. The breach exposed over 86 million records, including Social Security Numbers. This prolonged detection window allowed attackers extensive time to access and potentially monetize sensitive customer data.

Without effective monitoring and logging, suspicious activity can go undetected, giving attackers more time to exploit vulnerabilities and exfiltrate data.

Prevention:

• Implement centralized logging and real-time monitoring solutions
• Regularly analyze logs for anomalies
• Set up automated alerts for suspicious activity
• Establish baseline behavior to detect deviations

Pen Test Role: Pen testers attempt to bypass detection and exfiltrate data to identify gaps in monitoring systems and incident response processes.

Coinbase (2025): In May 2025, Coinbase confirmed a breach when cybercriminals bribed overseas support staff to leak sensitive customer data, including names, birthdates, email addresses, and partial Social Security numbers. Attackers used this data to orchestrate highly targeted social engineering attacks against customers. This breach highlighted the vulnerability of outsourced operations and the human element in security, demonstrating that even financial incentives can compromise insider threats.

Google Salesforce Breach (2025): In August 2025, Google confirmed a data breach from a compromised Salesforce-hosted corporate database. The hacking group ShinyHunters gained access through social engineering by impersonating IT support staff and tricking a Google employee into approving a malicious application. Even at tech giants with sophisticated security teams and trained personnel, social engineering remains remarkably effective.

Workday Breach (2025): On August 18, 2025, Workday disclosed a data breach stemming from a social engineering campaign where threat actors impersonated HR or IT staff. They contacted employees by phone or text to trick them into granting access to a third-party CRM platform. This demonstrates the evolving sophistication of social engineering tactics and the importance of verification procedures for access requests.

Humans are often the weakest link in cybersecurity. Attackers use phishing, pretexting, impersonation, and other social engineering tactics to manipulate employees into granting access.

Prevention:

• Conduct ongoing security awareness training
• Simulate phishing campaigns regularly
• Implement multi-factor authentication and verify requests for sensitive actions
• Establish clear protocols for verifying identity before granting access
• Create a culture where employees feel comfortable questioning suspicious requests

Pen Test Role: Pen testers simulate phishing attacks and social engineering scenarios to assess employee awareness and identify weak points in organizational security culture.

When you first click open the email, the first thing that draws your attention is the Zoom logo. It's familiar/recognizable, so if you're skimming through, you may let your guard down and miss all the other red flags.