Penetration testing and security validation approach - Article

Purpose

As a cloud service provider delivering a SaaS Learning Management System, Eurekos treats information security as a continuous responsibility and not as a periodic compliance activity. Our security approach is built around protecting the confidentiality, integrity, and availability of the information entrusted to us by customers, partners, learners, and administrators. This commitment is already reflected in our cybersecurity statement, technical security measures, secure development practices, and ISO-aligned governance framework.  

The cybersecurity landscape is changing rapidly. Modern AI-assisted tools can identify vulnerabilities, analyze code, chain weaknesses, and generate exploit paths faster than traditional manual processes were designed to handle. This does not fundamentally create new categories of risk, but it accelerates the speed, scale, and operational pressure around existing risks in application code, APIs, dependencies, infrastructure, identity, configuration, and production access.

For this reason, Eurekos combines independent penetration testing, continuous vulnerability scanning, secure development controls, automated quality assurance, DevSecOps maturity improvements, and AI-assisted security analysis into one integrated security validation model.

Security philosophy

Eurekos’ approach is based on a simple principle of continuous and proactive security testing, not only assessed retrospectively.

Traditional penetration testing remains important, because independent specialists can simulate realistic attack paths, challenge assumptions, and test how application components behave together in a running system. However, annual penetration testing alone is not sufficient in a release environment where new features, dependencies, infrastructure changes, and AI-assisted attack capabilities continuously change the risk landscape.

Therefore, Eurekos works with a layered model:

1. Annual full-scope penetration testing
   A broad, independent review of the application, infrastructure, APIs, authentication flows, authorization boundaries, and relevant operational assumptions. This provides a periodic full-system challenge and helps ensure that the wider codebase and platform architecture are assessed as a whole.
2. Feature-scoped penetration testing
   Targeted penetration testing is performed when new features, changed workflows, integrations, permissions, APIs, or customer-relevant security boundaries justify deeper validation before or after release.
3. Continuous vulnerability scanning
   Eurekos performs daily vulnerability scanning, where findings are generated by dedicated software and reviewed by the Security Officer. This supports ongoing discovery and prioritization of vulnerabilities before they can become exploitable issues.  
4. AI-assisted white-box security analysis
   Eurekos increasingly uses AI-assisted security analysis as a defensive advantage. Unlike external attackers, Eurekos can test with access to internal context such as code, dependencies, runtime assumptions, release history, and architecture. This allows us to identify vulnerabilities that may not be visible from a purely external black-box perspective.
5. Security gates in the development lifecycle
   Security is integrated into development practices through peer review, vulnerability identification tools, license checks, static analysis, QA, release management, and CI/CD workflows.  
6. Operational monitoring and threat intelligence
   Security validation continues after deployment through system monitoring, event logging, suspicious activity detection, threat intelligence, third-party severity assessments, and ongoing evaluation by the Information Security Steering Group.

Why penetration testing must become continuous

The purpose of penetration testing is not only to prove that a system was secure at a particular point in time. It is to continuously challenge whether security assumptions still hold as the product, threat landscape, and technical ecosystem evolve.

SaaS environments change constantly. New releases introduce functionality. Dependencies are updated. Cloud services evolve. AI capabilities create new opportunities for both defenders and attackers. Integrations, APIs, content processing, authentication, permissions, and administrative workflows all represent areas where small changes can create unexpected risk.

Eurekos therefore treats penetration testing as part of a broader continuous security validation process, where independent testing, automated scanning, secure development, operational monitoring, and risk governance reinforce each other.

A full-scope penetration test helps us test the complete platform. Feature-scoped tests help us validate meaningful changes close to the release cycle. AI-assisted scans help us find and prioritize vulnerabilities faster, especially where code context, dependency relationships, or configuration details provide insight that attackers do not have.

Integration with release and development processes

Eurekos’ development process already follows secure development principles, including managing coding and development vulnerabilities throughout the lifecycle, securing repositories, using version control safely, applying automation tools, and integrating continuous integration processes.  

Security validation is connected to release management in several ways:

• During development, code is reviewed, tested, and assessed using secure coding practices and automated tools. Code quality is reviewed before testing, and software tools are used to identify vulnerabilities including OWASP Top 10 issues, CORS concerns, DNS misconfigurations, and other known risk categories. 
• During QA and pre-production, Eurekos uses structured testing across QA, pre-production, and production environments. Regression testing verifies that existing functionality continues to work, while new functionality testing validates the intended changes. If a problem is found in pre-production, it is not released into production. 
• During release, changes follow a release and change management process with documentation, release notes, change logs, risk evaluation, and rollback capability. Eurekos uses rolling deployment to reduce downtime and support stable releases. 
• After release, critical features are tested again, monitoring continues, and findings from customers, support, monitoring systems, vulnerability scans, and penetration tests feed back into development priorities.

AI-assisted security testing and defender advantage

AI-assisted security testing is not a replacement for governance, engineering discipline, human expertise, or independent penetration testing. It is an additional instrument in the security toolbox.

The key defensive advantage is context. Attackers normally operate from the outside. They may see application behavior, public endpoints, and exposed services, but they do not have full access to internal design, code history, dependency structure, implementation intent, deployment configuration, and operational context. Eurekos can use that internal context to test earlier, deeper, and more frequently.

This supports:

• White-box vulnerability discovery across code and dependencies.
• Faster validation of suspected vulnerabilities.
• Better triage of findings based on exploitability and exposure.
• Detection of issues that traditional static analysis or black-box testing may miss.
• Security review of AI-generated or AI-assisted code before it reaches production.
• Testing of AI-related features, integrations, agents, prompts, retrieval flows, and tool access where applicable.

Eurekos’ AI policy already establishes that AI systems must be safe, secure, compliant, monitored, and governed, with AI-related risks assessed under the ISO 27001 risk methodology and aligned with ISO/IEC 42001 principles.

Policy-as-code and automated security gates

Manual review remains important, but it cannot be the only line of defence. As development velocity increases, Eurekos is moving further toward automated security gates that can identify, flag, block, or escalate insecure changes before they reach production.

This includes security controls in merge requests, dependency checks, vulnerability scanning, license validation, static analysis, and suspicious code detection. The objective is to make insecure changes fail early, rather than relying only on a reviewer to catch every possible issue.

Policy-as-code allows security requirements to be expressed as enforceable rules in the development pipeline. This helps prevent accidental insecure configuration, vulnerable dependencies, exposed secrets, unsafe code patterns, or suspicious changes from being merged without review and remediation.

This approach aligns with Eurekos’ DevSecOps maturity direction, where security activities are integrated into automated pipelines, supported by tools and technology, governed through compliance processes, and improved through metrics and feedback loops. 

Automated testing as a security enabler

Automated testing is not only a QA improvement. It is also a security enabler.

Automated functional and regression tests make it safer to apply dependency updates, security patches, framework changes, and automated merge requests. Without sufficient automated coverage, every update requires manual verification, which slows down patching and increases operational risk.

Eurekos’ objective is to strengthen automated test coverage so that dependency updates can be processed more safely through the CI/CD pipeline. When automated tests pass, security scans can run, merge requests can be evaluated, and updates can move forward with greater confidence. This reduces delay between the discovery of a vulnerability and the deployment of a fix.

In an AI-accelerated threat landscape, patching speed matters. The ability to validate and deploy fixes quickly becomes a security control in itself.

Continuous monitoring and threat detection

Eurekos combines pre-release security testing with post-release monitoring. Technical security measures include event logs, failed login tracking, system event tracking, monitoring of server login events, firewall protection, vulnerability scanning, and notifications for operational anomalies such as downtime, high CPU or RAM usage, low disk space, or increased error rates.  

The next stage of maturity is to make greater use of anomaly detection and machine-learning-assisted monitoring across aggregated logs and operational telemetry. The goal is not only to respond to known alerts, but also to identify unusual patterns, service behavior, account activity, outbound traffic, or build-system behavior that may indicate emerging risks.

This strengthens the ability to detect partial compromise, abnormal access, suspicious automation, or misconfiguration before it becomes a wider incident.

Chaos testing and resilience validation

Security is not only about preventing compromise. It is also about resilience.

Eurekos views chaos testing as a practical way to validate whether operational controls work under stress. This may include testing how services respond to partial outages, unavailable pods, infrastructure failures, deleted resources, backup restoration scenarios, access failures, or unexpected dependency disruption.

The objective is to understand how systems behave when assumptions break. This supports better recovery planning, improved monitoring, stronger backup validation, clearer responsibilities, and more realistic business continuity planning.

Chaos testing is especially relevant for SaaS operations because resilience must be proven, not assumed.

Continuous compliance and audit readiness

Eurekos’ security approach is supported by ISO-aligned governance. The Cyber Security Statement references ISO/IEC 27001, ISO/IEC 27017, and ISO/IEC 27701 as core frameworks, while the AI policy extends governance toward ISO/IEC 42001 principles.  

Continuous compliance automation supports this by collecting evidence more systematically across penetration testing, vulnerability scans, access control, backup procedures, supplier assessments, change management, incident handling, development controls, and monitoring activities.

The goal is to make compliance evidence a by-product of daily operations rather than a manual annual collection exercise. This strengthens audit readiness and provides a clearer operational picture of security maturity over time.

Governance and continuous improvement

Findings from penetration tests, vulnerability scans, monitoring, customer reports, service desk tickets, supplier notifications, and threat intelligence are evaluated and prioritized according to risk. Mitigations are planned and executed based on severity, exploitability, customer impact, and operational urgency.

Eurekos’ threat intelligence process includes monitoring emerging threats through daily operations, technical and strategic input, monitoring services, third-party severity assessments, customer dialogue, quarterly aggregated updates, and security partner recommendations. These inputs are processed by the Information Security Steering Group where relevant.  

This creates a continuous improvement loop:

1. Identify risks through testing, scanning, monitoring, and threat intelligence.
2. Validate whether findings are real, exploitable, and relevant.
3. Prioritize based on impact, exposure, and urgency.
4. Remediate through development, configuration, patching, or process change.
5. Retest to confirm that remediation is effective.
6. Feed lessons learned into policies, procedures, automation, and release controls.

Our commitment

Eurekos continuously develops its security testing approach because the threat landscape continuously changes. We combine independent penetration testing, feature-scoped security reviews, weekly vulnerability scanning, secure development practices, AI-assisted vulnerability discovery, operational monitoring, and ISO-aligned governance to reduce risk throughout the full software lifecycle.

Our position is that cybersecurity cannot rely on a single annual test, a single tool, or a single review process. It must be embedded into how software is designed, built, reviewed, tested, released, monitored, and improved.

As AI increases the speed at which vulnerabilities can be discovered and exploited, Eurekos proactively adopts new instruments to strengthen defensive capability, improve remediation speed, and preserve customer trust. Our aim is to remain prepared not only for today’s threat landscape, but for the next generation of security challenges as well.