The Challenge: Risk Exposure Between Tests
A leading insurance provider relied on annual penetration tests to assess their external infrastructure and web applications. Each year, they received a PDF report, which was then manually broken down into spreadsheets, distributed across security and IT teams, and tracked through email chains and meetings.
This approach left them with three major challenges:
- Extended Risk Windows – Vulnerabilities went unaddressed for months until the next scheduled test, leaving critical exposures unchecked.
- Inefficient Remediation – Security teams wasted time manually carving up reports, chasing teams for status updates, and managing remediation through spreadsheets.
- Manual Risk Prioritization – While some internal processes existed to assess business risk, prioritization was a slow, manual effort, often delaying the remediation of critical vulnerabilities.
The Solution: Continuous Penetration Testing
To eliminate risk gaps and streamline remediation, the company moved to Rootshell’s continuous penetration testing model, which integrates:
- 24/7 Continuous Scanning – Web applications and external infrastructure are monitored in real time, identifying new vulnerabilities as they emerge.
- AI-Powered Threat Intelligence – Our AI, Velma, continuously correlates emerging exploits with the company’s attack surface, flagging threats that actively impact their systems.
- Deep-Dive Manual Testing – Rootshell’s ethical hacking team regularly analyzes findings, validates high-risk attack chains, and ensures critical weaknesses don’t go unnoticed.
The Operational Shift: From Spreadsheets to Automation
Beyond identifying vulnerabilities, the Rootshell Platform transformed their remediation process with:
- Internal Remediation SLAs – Vulnerabilities now have defined resolution timelines, holding teams accountable to fix issues based on risk level.
- Automated Risk-Based Prioritization – Instead of manually analyzing and ranking risks, the platform automatically prioritizes vulnerabilities based on asset value, exploitability, and real-world threats—removing bottlenecks from the decision-making process.
- Role-Based Access Controls – The company assigned specific teams to specific vulnerabilities, ensuring the right people get the right data—without the noise.
- Ticketing System Integration – Vulnerabilities now flow directly into their ITSM platform, eliminating the need for manual data entry and status tracking.
- “If This, Then That” Rules – Security teams set up workflows that automatically escalate critical vulnerabilities, ensuring urgent issues are addressed immediately—not buried in a backlog.
The Results: Security Without the Lag
- Closed Risk Gaps – No more months-long exposure between tests—threats are now identified and addressed continuously.
- 62% Reduction in Mean Time to Remediate (MTTR) – By automating workflows, the security team spends less time chasing updates and more time fixing real threats.
- Real-Time Risk Visibility – A dynamic dashboard replaced outdated reports, giving security teams a live view of their organization’s security posture.
- Manual Effort Reduced by 70% – The move from spreadsheets to automation freed up resources to focus on proactive risk reduction.
Rootshell’s platform gives me the visibility to easily understand issues, approve projects, and collaborate with colleagues, so that our remediation process is as streamlined as possible.
Stephen Shackell, Director of Intelligence and Risk
The Bottom Line: Insurance Against Cyber Risk
For an industry built on risk management, relying on point-in-time penetration testing was a gamble they could no longer afford.
By shifting to continuous testing and automated remediation, this insurer closed risk windows, accelerated vulnerability resolution, and eliminated inefficiencies—ensuring they stay ahead of both attackers and regulatory requirements.
