Almost two weeks. That's how long the personal data of roughly 50 million Bangladeshis stayed exposed in 2023, and the researcher who found it says repeated attempts to reach BGD e-GOV CIRT went unanswered.

That gap between a bug appearing and a bug being fixed is where breaches live. Continuous pentesting targets it directly by testing as you ship, so your remediation time stops depending on a yearly calendar.

The urgency is real. Verizon's 2026 DBIR puts the median time to fully patch a vulnerability at 43 days, up from 32 the year before. Mandiant estimates attackers now exploit new flaws, on average, seven days before a patch exists.

Below you'll see where the days actually go, what Bangladesh's Cyber Security Ordinance 2025 means for your testing, free tools to start with, and a 30-day rollout plan that fits a lean team.

Why Your Remediation Time Keeps Growing

Verizon's 2026 Data Breach Investigations Report (DBIR) found that exploiting software flaws overtook stolen credentials as the most common way into a network, the first time that has happened in the report's history. Exploitation now starts 31% of breaches, according to the same study.

Vulnerability remediation, the work of fixing a flaw once it's found, is where defenders are losing ground. Only 26% of critical flaws on CISA's Known Exploited Vulnerabilities (KEV) list, a catalog of bugs criminals are already using, were fully fixed during 2025, down from 38% the year before. The median time to fully patch climbed from 32 to 43 days.

Attackers run on a different clock. Mandiant's M-Trends 2026 estimates the mean time to exploit a new vulnerability at −7 days, meaning exploitation often begins before a patch exists. Once inside, access gets passed to other criminal groups in a median of 22 seconds, versus more than eight hours in 2022.

Figure 1. Attackers now exploit flaws before patches exist; defenders still take weeks to fix.

Now picture a yearly pentest against that backdrop. A test in March can't see the flaw you ship in July. And your remediation time, the days between a flaw being found and the fix being verified, starts counting from the wrong day.

The Annual Pentest Problem: Waiting Is Built In

A penetration test (pentest) is an authorized, controlled attack on your own systems to find exploitable weaknesses before criminals do. For most companies it's a yearly event. Forty percent of organizations still test mainly for compliance, which tends to mean one engagement, one PDF, one audit date.

Follow a single bug through that rhythm. It ships on a Tuesday. It waits, for weeks or months, for the next scheduled test. Then it lands in a report, gets debated, ticketed and fixed, and often isn't retested until next year.

The code change is often small. The queue around it isn't.

Continuous pentesting, also called continuous penetration testing and often sold as penetration testing as a service (PTaaS), replaces the yearly event with an ongoing program. Testers re-attack whenever your app, API or infrastructure changes. Findings appear live as they're confirmed, and fixes get retested on request.

Figure 2. Annual pentesting builds waiting into remediation time; continuous pentesting removes the queues.

The market is already moving. Cobalt's 2026 survey found 53% of organizations now take a programmatic approach (continuous, integrated and risk-driven), the first time it has overtaken compliance-led testing.

The Five Delays Inside Your Remediation Time

Remediation time isn't one number. It's five queues stacked end to end, and continuous pentesting cuts into each one.

1. Discovery lag: from yearly to every release

Testing triggers on change (a new feature, a new API endpoint, an infrastructure update) instead of the calendar. A flaw gets found days after it ships, not months. The developer who wrote it still remembers why, which makes the fix faster.

2. Reporting lag: live findings, not a final PDF

Confirmed findings appear in a shared dashboard or channel as testers verify them. Waiting for a report to be written, reviewed and delivered can add days even when the flaw was found on day one.

3. Triage lag: proof beats scores

A finding with a working proof-of-concept ends the "is this real?" debate. Add context rather than leaning on a severity score alone: is the asset internet-facing, is the flaw known to be exploited, can an attacker automate it? That is the logic behind CISA's BOD 26-04, which weighs exposure, KEV status, automation and technical impact.

4. Fix lag: an owner and a clock

Every finding becomes a ticket with one named owner and a deadline set by severity. Without that, findings drift into "shared responsibility," which usually means nobody's. The gap is real: three-quarters of organizations set a 14-day-or-faster target for serious findings, yet the median time to resolve them was 37 days.

5. Retest lag: a fix isn't a fix until it's verified

On-demand retesting turns "we think we patched it" into "confirmed closed." In an annual cycle, that confirmation can wait for the next engagement, and an unverified fix is a guess.

What the Data Says About Continuous Pentesting

Cobalt's 2026 State of Pentesting Report combines thousands of tests with a survey of 450 security professionals, and it draws a sharp line. Teams taking a programmatic approach are 4.5x more likely to fix critical findings within three days: 45% of them do, versus 10% of compliance-driven teams.

The extremes are starker. The top 10% of organizations close half of their high-risk findings in about 10 days. The bottom 10% take 249 days. That's the "half-life" of a finding: how long it takes to resolve 50% of them, including the ones still open.

Figure 4. Programmatic, continuous testing teams fix critical findings far faster than compliance-driven teams.

A word of caution before you promise your CEO "half." This is leaders versus laggards, not a controlled before-and-after, and Cobalt sells pentesting. Read it as a strong signal, not a guarantee. It still gives you a sane first target: halve your own number before chasing anyone else's.

Bangladesh Case Files: Two Bugs, Two Clocks

The 50-million-record exposure (2023)

On June 27, 2023, researcher Viktor Markopoulos discovered that personal data of more than 50 million people was reachable through a .gov.bd website, while searching Google for an SQL error. By his description, changing a single value was enough to pull up a random person's birth application. That pattern, where tweaking one identifier exposes someone else's record, is what testers call IDOR (insecure direct object reference).

He says he contacted BGD e-GOV CIRT several times and got no response. CIRT published a statement on July 8, and the data was removed on July 9, almost two weeks after discovery. Officials blamed a weakness in a partner organization's system, not a cyberattack.

Continuous testing wouldn't have fixed an unmonitored inbox. But routine testing of every internet-facing endpoint, partner-run ones included, is how your own people find a flaw like this first. And it comes with a named owner and a clock.

Figure 5. The 2023 exposure: almost two weeks from discovery to takedown.

The accreditation portal (January 2026)

On January 31, 2026, the Election Commission's media-accreditation portal showed every applicant to anyone who logged in, exposing data on about 14,000 journalists: NID numbers, phone numbers and full application files. Access was disabled shortly after the flaw was spotted. The portal had been built for the 13th national parliamentary election and referendum.

Deadline-driven launches are where untested logic hides. A test before go-live, and another after every change, costs far less than a leak with your name on it.

What the Cyber Security Ordinance 2025 Means for Your Testing

Four things matter for a Bangladeshi team running continuous pentesting.

Get written authorization first. The Ordinance prohibits unauthorized access to computer systems and critical information infrastructure, so a tester without signed scope is legally an intruder. Spell out systems, IP ranges, dates and emergency contacts, and get consent from any third party that hosts what you're testing.

Periodic assessments are the direction of travel. Commentary on the Ordinance notes it dedicates a chapter to prevention and mandates periodic vulnerability assessments. It also creates the National Cyber Security Agency, and operators of critical infrastructure and government bodies must notify authorities of cyber incidents.

Banks, NBFIs and mobile financial services have their own rulebook. Bangladesh Bank's ICT security guideline applies to banks, NBFIs and payment and MFS providers. The 2015 edition has a dedicated section on vulnerability assessment and penetration testing, and version 4.0 followed in April 2023.

Know where to report. If a test uncovers signs of a live compromise, report through BGD e-GOV CIRT's incident-reporting page or [email protected].

This is a practical summary, not legal advice. Confirm your obligations with counsel.

Your 30-Day Rollout: A Continuous Pentesting Checklist

You don't need a big budget. You need a scope, a clock and a loop. Lean teams have an edge too: in Cobalt's 2025 data, larger organizations took more than a month longer than smaller ones to resolve serious findings (61 days versus 27). One decision-maker and one backlog is an advantage, so don't give it away.

Figure 6. A 30-day continuous pentesting rollout, week by week.

Map your internet-facing assets. Domains, subdomains, APIs, admin panels, VPNs, mail gateways. Start with edge devices: in the 2025 DBIR, VPN and edge-device exploitation grew from 3% to 22% of exploitation vectors.

Sign the scope. Written authorization, IP ranges, test windows, emergency contacts and data-handling rules.

Baseline your crown jewels. Login, payments, KYC and NID data, admin functions. A deep first test tells you your starting remediation time.

Set severity-based SLAs. CISA's BOD 26-04 uses tiers of three days, 14 days, 60 days and formal deferral. It binds only US federal agencies, but it's a handy benchmark. Scale it to your team's capacity.

Pipe findings into tools developers already use. Jira, GitHub Issues or Slack, with one named owner per ticket.

Agree a retest window. Closing a ticket isn't closing a finding. Pick a number (two business days is a sensible start for criticals) and keep it.

Review monthly. Track three numbers: half-life of high-risk findings, percentage of criticals fixed inside SLA, and reopen rate.

What's New: AI Is Flooding the Remediation Queue

Defenders aren't only racing attackers anymore. They're racing volume. Epoch AI counted roughly 2,500 high- and critical-severity CVEs published in July 2026, about five times the monthly record set before AI-driven discovery programs such as Anthropic's Project Glasswing began.

CISA noticed. BOD 26-04, issued June 10, 2026, replaces flat deadlines with a risk-based model, and CISA said it is responding partly to AI's impact on vulnerability volume and shrinking remediation timelines. The tightest tier gives federal agencies three days.

Figure 7. AI-driven discovery pushed monthly high-severity CVE disclosures to about five times the old record.

What does that mean for you? You can't fix everything, so prove what's exploitable. A pentest that chains a flaw to real access outranks any score on a spreadsheet.

Watch your AI features too. Cobalt found 32% of AI and LLM findings were rated high risk, against 12% across all its findings.

FAQ: Continuous Pentesting and Remediation Time

What is continuous pentesting?

Continuous pentesting is an ongoing program of authorized attack simulations that run whenever your applications, APIs or infrastructure change, rather than once a year. Human testers confirm findings, deliver them live to your team and retest after fixes. It is commonly delivered as penetration testing as a service (PTaaS).

How is continuous pentesting different from vulnerability scanning?

A vulnerability scan is an automated check for known flaws and misconfigurations. A pentest adds human judgment: testers chain weaknesses together, prove what is actually exploitable and show business impact. Continuous pentesting pairs frequent automated coverage with targeted manual testing whenever something important changes.

How much can continuous pentesting reduce remediation time?

No honest vendor can guarantee a figure, but the data is encouraging. Cobalt's 2026 report found programmatic teams were 4.5 times more likely to fix critical findings within three days, and top performers closed half of high-risk findings in about 10 days. Baseline your current half-life first, then aim to halve it.

Is penetration testing legal in Bangladesh?

Yes, when it is authorized. Bangladesh's Cyber Security Ordinance 2025 prohibits unauthorized access to computer systems, so every test needs written permission defining scope, dates and systems, including third-party hosts. Banks and mobile financial services must also follow Bangladesh Bank's ICT security guideline. Confirm specifics with legal counsel.

How often should a Bangladeshi business run a pentest?

Test on change, not just on the calendar: after every major release, new internet-facing service or infrastructure shift, plus a scheduled deep test of your most critical systems at least yearly. Regulated entities and critical infrastructure operators should also follow their sector rules, which point toward periodic vulnerability assessments.

The Bottom Line

Remediation time isn't a developer problem. It's a calendar problem, a queue problem and an ownership problem, and continuous pentesting attacks all three. Attackers already work on a clock measured in days, sometimes before a patch exists. Pick one internet-facing system, get written authorization, measure its half-life, and make your next fix twice as fast as your last, then do it again.

Want to know how long your own bugs stay open? Book a free consultation with our team and get a remediation-time baseline for your most exposed system.