Why your last pentest expired

The report is not wrong. It is finished.

A penetration test report does not expire the way a certificate does. Nothing flips a flag. No line in the findings table turns red on a date you can put in a calendar invite. What expires is quieter than that, and harder to notice: the distance between the system the tester examined and the system you are running today.

That distance grows on its own. It grows every time a team merges a change, opens a port for a vendor, rotates a credential, or promotes a container image that was never part of the tested scope. None of those events look like security decisions. Every one of them moves the target.

What the tester actually tested

When you read a report, read the scope first. Scope is where the real boundary of the report lives, and scope is almost always narrower than the system you believe you run. The tester was handed a list of hosts, a set of credentials, sometimes a persona or two. They were not handed the internal service that shipped the month after the engagement closed, the staging environment that quietly acquired a public DNS record, or the jump host somebody stood up during an incident and never tore down.

A test tells you what is true about what it touched. The moment scope stops matching reality, the report stops being evidence about your environment and becomes evidence about an environment that used to exist. This is not a criticism of testers. It is the nature of the format. A snapshot has a shelf life because the subject keeps moving.

What survives the expiry

Some of the report is durable, and it is worth knowing which parts.

A finding you fixed is durable — but only if you can show the fix. The tester showed an endpoint returning records without authentication. You fixed it. The proof is the retest, not the ticket that says done. If the remediation note does not carry the evidence, the finding is only as closed as your memory of it.

A finding you accepted is durable in a different way. Accepted risk with a named owner and a review date is a decision, and decisions hold up. Accepted risk with neither is a finding that expired in silence. When we look at a two-year-old report, that is the most common thing we find: not missed vulnerabilities, but unanswered ones.

Attackers do not respect your test date

The person you are most concerned about does not read your report. They approach the environment the way an outsider would: enumerate what answers, look for the thing nobody documented, and take the path of least resistance. If your tested surface and your live surface have diverged, they will find the divergence long before your next engagement does.

That asymmetry is the entire argument for continuity. A periodic test gives you a point. An attacker works with a line. The question is never whether your last test was good. It is how much has changed since, and whether anyone has been watching.

What to do with the expiry

Three things, and none of them require a budget cycle.

Keep a delta log. Every change that alters what a tester would see — a new external host, a new authentication flow, a new data store, a new privileged role — gets one line. When the next engagement starts, hand the tester the delta. It turns a cold start into a warm one, and it makes the report shorter because the tester stops rediscovering your environment.

Retest on triggers, not only on the calendar. A major release, a new integration, a change in who can reach what — any of these is a better reason to retest than the quarter boundary you inherited from procurement.

Re-read the accepted findings. For each one, ask who owns it and when it was last reviewed. The ones with no answer are the findings that actually expired. They are also the cheapest thing on this list to fix, because the analysis is already done.

The point

The goal was never to have a test. The goal is to have evidence you can defend, and evidence has a shelf life because systems change — not because the testing was bad.

Run the test. Then keep the distance small between what was tested and what is running, and keep it small on purpose.