Where the Money Moves, the Attackers Follow: Rethinking What Your Pentest Should Prove

The Scoping Meeting Nobody Remembers

Ask a CISO what was in scope for last year's penetration test and the answer rarely changes: external infrastructure, a handful of web applications, perhaps a social engineering exercise if the budget allowed. Ask the same executive where the company's largest cyber losses occurred over the past three years, and the story shifts entirely—to fraudulent wire instructions, manipulated vendor portals, and payment approvals routed through compromised mailboxes.

This mismatch is not accidental. It is the predictable result of how penetration testing is bought, sold, and scoped in the American market.

Why the Test Targets What It Targets

Penetration testing engagements are scoped around what can be cleanly measured. A vulnerable web application produces a finding with a CVE, a severity rating, and a remediation path. An exploitable network segment maps neatly to a compliance checkbox under PCI DSS or a framework control. These deliverables fit procurement templates, satisfy auditors, and can be compared year over year.

Business process compromise offers no such tidiness. Simulating an attack on accounts payable requires access to real workflow documentation, cooperation from finance staff, and a legal framework governing what the testers may do with actual invoice templates and banking details. The engagement is messier, the findings are harder to write, and the deliverable looks less like a vulnerability report and more like an operational audit—which procurement teams are rarely equipped to evaluate.

So the industry tests the firewall. The attackers test the CFO's inbox.

What the Loss Data Actually Shows

FBI Internet Crime Complaint Center reporting has placed business email compromise losses in the billions of dollars annually, dwarfing losses attributable to the ransomware-adjacent infrastructure intrusions that dominate security conference agendas. The pattern in these cases is consistent: adversaries spend weeks studying an organization's payment cadence, vendor relationships, and approval hierarchy, then strike through a single well-timed request that looks indistinguishable from legitimate operations.

No amount of network segmentation testing detects this. A clean external pentest report provides no assurance whatsoever that a fraudulent change-of-banking-details request would be caught before the wire clears.

A Framework for Scoping What Matters

Organizations commissioning adversary simulation should apply four filters before signing the statement of work:

1. Map the money. Identify every workflow that moves funds, changes banking information, or grants payment authority. These are the crown jewels of modern intrusion, not the DMZ.

2. Test the humans in the approval chain, not just the technology. A simulation should exercise the verification callbacks, dual-authorization controls, and escalation paths that finance teams are supposed to follow under pressure.

3. Include the vendor perimeter. Supplier portals, third-party invoice systems, and shared procurement platforms are where adversaries establish their foothold. If your simulation never touches them, it is modeling an attacker who does not exist.

4. Demand findings in operational language. A report that says "an attacker could have initiated a fraudulent $2.4 million wire by exploiting absent callback verification" is worth more to a board than forty low-severity infrastructure findings.

Redefining What a Passing Grade Looks Like

The uncomfortable truth is that many organizations prefer the test they can pass. Infrastructure findings can be remediated on a schedule; a failed payment-process simulation implicates leadership, training budgets, and cross-departmental coordination between IT and finance—two functions that in many US enterprises still operate in separate reporting lines.

But decisive security leaders should treat this as the point, not the problem. The pentest that makes everyone uncomfortable is usually the one measuring something real. When next year's engagement is scoped, the question worth asking is not "what did the testers find?" but rather "what did we pay to avoid having tested?"

Adversary simulation exists to answer a single question: could a motivated, well-resourced attacker actually take something of value from us? For most American enterprises right now, the honest answer runs through accounts payable—not through the perimeter the annual report already declares secure.