In short: A clean system pen test report shows what an attacker can reach from outside. Testers rarely look inside the code, and in legacy software, the riskiest flaws often hide in components that no longer get security fixes. AI-assisted source code review finds them before attackers’ AI tools do.
You commissioned an independent security test of your IT infrastructure and the applications running on it. Your systems passed, but if one has been running for over 10 years, the report may tell you less than you think.
Penetration tests are authorised attempts to break into systems, carried out by specialists who act like an attacker. They probe sign-in pages, web addresses and network settings, looking for a way in. But they rarely get to see the code underneath.
What pen tests are good at catching
Effective tests spot password rules loose enough to allow short, guessable passwords. They’ll also flag outdated encryption settings, and any genuine company web address that sends visitors to an attacker’s site for a convincing phishing scam.
Testers find these because anyone can see them from the outside, regardless of the system’s age.
What they miss in older software
An external tester can only find what responds when they knock. A flaw buried in the code gives no response to a web request, so it stays hidden.
Say the test flags one page where a signed-in user can see a colleague’s records. A developer opens the code behind that page, restores the missing permission check, and the finding is closed.
Other pages built the same way may be missing the same check, and that fix won’t touch them. A source code review reads the whole application, so it turns up every page missing that check.
Older systems make this worse. Several applications often share a component, so a flaw can affect systems that look unconnected.
Then there’s the question of which version the testers saw. If they worked on a non-production copy and nobody audits how changes reach the live system, you can’t prove that what runs today matches what passed.
Staff-only systems need the same scrutiny
Internal tools can fall outside a test’s scope. Our own reviews have found some of the most serious weaknesses in these tools, written years ago for a handful of users and never updated since.
One phishing email that compromises a staff account puts an attacker inside, where those tools assume everyone is friendly.
Why the gap is widening
The National Cyber Security Centre expects AI tools to make attackers faster at exploiting weaknesses by 2027, with more attacks targeting systems that haven’t received security updates.
In October 2026, researchers used AI to turn decades-old PHP flaws into working attacks, and the NCSC told organisations to take offline any system they couldn’t patch straight away.
Many legacy applications run on end-of-life frameworks and databases that their makers stopped supporting years ago. Flaws in that software still get found and published, yet no official fix will ever follow.
Defenders can only keep pace by using AI themselves. Our AI-assisted analysis lets an engineer trace how a system handles sign-in and permissions across every component in one pass. The team can then fix the weaknesses an attacker’s tools would hunt for, before anyone exploits them.
Speed matters for another reason. Findings on legacy software can stay open for months because fixing them requires someone who understands the code. That’s usually a developer who’s already stretched, or one who has left the business.
How we close what the test leaves open
Our support-led approach to system modernisation starts from here. Our engineers use AI-assisted tooling to read the code alongside its configuration, then prioritise with you which weaknesses to fix first, beginning with those open to misuse today. It’s the same work that can make keeping an older system cheaper than a replacement project.
We analyse every change for security weaknesses before accepting it, and send anything affecting sign-in, permissions or personal data for a peer review. That stops the same shortcuts from creeping back in. Engineers make every decision, while the tooling speeds up the reading.
Your next pen test still has a job to do, and it will have fewer easy wins to report. If your last report came back clean, find out how much of your system the test covered.
Book a 20-minute call and hear how we’d make the old software you still rely on more secure. Tell us what it does and who looks after it today, and we’ll explain where we’d start.