There is a moment in most first conversations we have with a new client where the same thing comes up. They had a penetration test done. It went well, or well enough. The report is in a drawer. And they'd like to know why, eleven months later, we're suggesting they think about their systems differently.
The honest answer is that the test was fine. What changed is the other side.
Our R&D Lab published a paper earlier this year on the role of AI in ethical and unethical hacking, and the finding that stuck with most of us wasn't the headline numbers, although those are stark enough. AI-generated malware rose 125% in a year. AI-assisted ransomware rose 67%. Eighty-five percent of security professionals say AI-driven attacks are harder to detect than what came before.
The finding that mattered was quieter. AI didn't make attackers smarter. It made them tireless.
A few years ago, probing a company's systems for weaknesses was work. Somebody had to sit down, map the exposed surface, try things, read the responses, try other things. It was slow, it needed skill, and it needed to be worth the effort. That meant most businesses, particularly mid-sized South African ones, were simply never looked at closely. Not because they were secure. Because they weren't worth the hours.
That arithmetic has gone. The reconnaissance our own team uses AI to accelerate is the same reconnaissance available to anyone with a subscription and bad intentions. A scanner running against your public-facing systems doesn't get bored, doesn't need to be paid, and doesn't stop at five o'clock. It runs tonight, and again tomorrow, and it will notice the moment something changes.
Research published this year puts the gap between a new vulnerability being disclosed and a working exploit appearing at a matter of hours. Two years ago it was measured in weeks.
None of this makes a penetration test less valuable. A good test, done by people who understand how systems are actually misused, finds things no scanner will. Our business logic paper is a decent illustration. Our team bought R5,000 of goods from an account holding R10, and no tool on earth would have flagged it, because nothing was technically broken.
But a test answers one question: how secure were you on the day it ran?
That was a reasonable question when the threat was occasional. It isn't now. Your environment changes weekly. Software updates. A supplier opens a port. A certificate lapses. Somebody stands up a test server and forgets it. Every one of those is a new door, and there is now something on the other side of it checking the handle every single night.
A photograph of your security taken in March tells you very little about a door that opened in August.
This is the thinking behind Magix CVM, and it's worth being plain about what it is and isn't.
It is not more scanning for its own sake. Anyone can run a tool monthly and email you the output. What most businesses get from that is a 400-page PDF that nobody opens, full of findings that may or may not matter.
What we do every month is scan the internal network, the external systems, the websites and web applications, and then have a person review every finding. That's the part that matters. Our specialists work out which ones actually put your business at risk, rank them, and hand you a short list. Not everything. What to fix first.
Then the next month we do it again. And if you've fixed things, the list is shorter.
That shrinking list is the whole point. It's the difference between a service that generates reports and one that generates progress. It's also the thing an annual test can never give you, because a single test has no next time to compare against.
We've been running continuous vulnerability management for clients across South Africa long enough to have some opinions.
The first is that the initial month is always humbling. Nobody has ever come through a first cycle with nothing on the list. That's not a criticism of anyone's IT team. It's what happens when you look properly at an environment that hasn't been looked at properly.
The second is that the value compounds. Month three looks very different from month one. By month six, most clients are dealing with new findings as they appear rather than working down a backlog, which is what the whole thing is for.
"The clients who get the most out of this are the ones who stop thinking of security as an event," says Kevin Wotshela, Managing Director at Magix. "An annual test is an event. You prepare for it, you get through it, you move on. Continuous management is closer to a habit. Nothing dramatic happens most months, and that's exactly the outcome you want."
The third thing we've learned is that you don't need a security team to do this. The scanning, the review, the ranking, that's our job. What we hand over is readable by whoever runs your business. If you can work through a to-do list, you can act on it.
If your last penetration test is more than a year old, that's worth addressing on its own. But the more useful question is whether anyone is looking at your systems between tests, because someone else certainly is.
Continuous vulnerability management isn't a replacement for good testing. It's the part that fills the gap between tests, which is where the risk now lives. The attackers moved to continuous. It's a reasonable time to follow.
