Why Passing a Penetration Test Doesn't Mean You're Secure | Michael Koppmann, OWASP Vienna

Passing a penetration test does not mean you are secure. A pen test is a snapshot with a defined scope and limited time. It can prove that vulnerabilities exist, but it can never prove that none do. That is the first answer Michael Koppmann gives in this Cyber Answered conversation, and it is one every CISO and security leader needs ready when someone holds up a clean pen test report and asks whether the job is done. Michael is a Senior Information Security Consultant at SBA Research in Vienna, an OWASP Vienna chapter leader and co-founder of the sec4dev conference. He has spent nine years running penetration tests on web, mobile and cloud applications, auditing source code and training developers in secure coding for APIs and microservices. Host Vasileios Kospanos met him at OWASP Global AppSec EU 2026, where Michael led the volunteer team, and puts ten questions to him on penetration testing, application security (AppSec) and secure software development. You'll get: What a penetration test can and cannot tell you Why broken access control is still one of the most common vulnerabilities in web, mobile and cloud apps in 2026, and why tooling can't solve it for you Compliance vs security: what an OWASP SAMM (Software Assurance Maturity Model) assessment really measures How a source code review exposed a permission flaw in Michael's own security project, years after he wrote it The secure coding habit every developer needs before writing a line of code The free OWASP resources beyond the OWASP Top 10: ASVS, the Cheat Sheet Series and SAMM Why a commercial VPN moves trust rather than removing it The highest-leverage move when you can't afford a full security team: identity management, single sign-on (SSO) and multi-factor authentication (MFA) Timestamps 0:00 Intro: Michael Koppmann, SBA Research and OWASP Vienna 1:40 What a penetration test involves, and what it can't tell you 2:52 The vulnerability still found constantly in 2026: broken access control 4:37 What OWASP stands for now 5:23 Compliant vs secure: what OWASP SAMM really measures 6:56 The source code audit that exposed a flaw in his own code 9:45 The one habit every developer needs before writing code 11:30 Offensive security vs sustainable software, the Cyber Resilience Act and CSRD 14:00 Free OWASP guidance beyond the Top 10: ASVS and the Cheat Sheet Series 15:35 Michael's run for the OWASP board of directors 16:28 Online privacy: why a VPN is not a magic privacy button 18:56 Why pen testers build their own in-house tools 21:24 No budget for a full security team? Start with identity management, SSO and MFA 22:56 Where to find Michael 24:39 OWASP Global AppSec EU 2027 in Vienna Links Michael's website: mkoppmann.at Michael's TEDxTUWien talk, The Era of Green Software: www.mkoppmann.at/blog/the-era-of-green-software/ OWASP Vienna chapter: owasp.org/www-chapter-vienna/ OWASP Cheat Sheet Series: cheatsheetseries.owasp.org About Cyber Answered Cyber Answered is a private, invite-only network for security leaders running security under pressure. The Security Library: short video answers to your hardest problems, from CISOs and security leaders who've faced them. No vendor pitches or hour-long webinars, just practical lessons organised by problem, not product. Private security roundtables: small, off-the-record sessions with peers from similar organisations, team sizes and risk profiles. Request an invite: cyberanswered.com #PenetrationTesting #OWASP #CISO #AppSec #CyberSecurity