Continuous Penetration Testing
Find out about a new exposure in days, not at next year's test, and only the ones worth your team's time. The testers who know your environment keep checking it, filter out the noise, and review every finding before it reaches you.
What You Get
Fewer surprises, less noise
Everything arrives through the client portal you already use for the annual test, with a discussion thread on every finding and retests requested from the same screen.
Know in days, not at next year's test
A port opens, a forgotten subdomain goes live, a version on your perimeter changes. Checks run at a cadence you agree, from weekly to several times a day, so the gap between a change and someone noticing it shrinks from months to days.
Your team only sees what matters
No raw feed of scanner alerts to triage. Repeats, flapping services and known noise are filtered out automatically, and the testers who know your environment review every finding before it reaches you.
Findings you can act on, not alerts
Every finding is validated and reviewed by a tester, written up with reproduction steps and a fix, and published to your portal with an email to your team.
An answer when someone asks what changed
When the board, an auditor or a customer questionnaire asks what happened since the last test, the cycle report already opens with what changed since the report we delivered.
New features tested as they ship
For applications, testers come back to new or changed functionality, or to the areas you point us at, using a bucket of hours scoped up front. Your release cadence stops outrunning your pentest.
A heads-up when it is serious
We match newly exploited vulnerabilities against the software we have seen on your systems and watch for domains registered to look like yours. When something severe affects you, a person tells you directly.
Your Audit Stays Covered
It builds on the annual test. It does not replace it.
Compliance frameworks ask for a point-in-time penetration test: PCI DSS at least every twelve months and after significant change, and SOC 2 auditors expect a recent one. You keep that test, with the scope, methodology and report your auditor accepts, and it is where a continuous engagement begins.
What changes is the eleven months after it. Instead of a report that ages from the day it lands, you have a record that stays current, and a straight answer when someone asks whether anything has changed.
How It Works
Three depths, at the cadence you agree
Each depth also counts as the ones below it. The most frequent settings can trip rate limits or your own monitoring, so they run only by agreement, and nothing is scanned so often that a slow network is busy most of the day.
Light checks
Weekly, up to every six hours
A port that opened, a service version that changed on any port we already know about, a web application that changed, a hostname that moved to a new address.
Deeper checks
Monthly, up to every few days
Vulnerabilities a scanner template can detect, new names on your TLS certificates, component versions we watch for new CVEs, and fresh breach credentials for your domains.
Full discovery
Quarterly, up to every two weeks
A fresh run of the complete pipeline: every port rather than the common ones, UDP, a full vulnerability scan, new subdomains, and changes to the IP ranges your organization announces.
Why You See Less Noise
Noise filtered, every finding reviewed
Most of what a scan turns up between tests is expected, harmless or already known. A raw feed of it is work handed to your team. These rules are why it does not reach you.
- Every change is compared with the last known state of that host, so you hear about what is new, not the same open port every week.
- Something that flips back and forth within two weeks is logged, not raised.
- Scanner hits land unvalidated. Nothing reaches your portal until a tester has reviewed it.
- Known noise, such as catch-all pages and keys that are meant to be public, is closed with the reason recorded, so the decision can be checked later.
- Breach credentials are never closed automatically.
Is It For You
When it earns its cost, and when it does not
A good fit when
- You ship to production weekly or faster, and last year's scope is already out of date
- Your external footprint changes: new cloud accounts, acquisitions, marketing sites nobody told security about
- Customers or a board are asking what happened since the last annual test
- You want the testers who learned your environment to keep watching it
Probably not, if
- A stable environment with one annual compliance requirement. A single well-scoped test is the right purchase.
- You want raw scanner output to triage yourself. A scanner or attack surface tool costs less.
- You need 24/7 detection and response. That is a SOC or MDR provider; we test, we do not monitor your logs.
FAQ
Continuous penetration testing questions
Does continuous testing replace our annual penetration test?
No. PCI DSS Requirement 11.4 asks for testing at least every twelve months and after significant change, and SOC 2 auditors expect a recent penetration test. Those are point-in-time tests with a scope, a methodology and a report, and that is what an auditor accepts. Continuous testing starts from that test and covers the time between, on the same scope and the same record.
How is this different from an attack surface management tool or a vulnerability scanner?
The scanning is similar; what happens next is not. A tool alerts on everything it sees and leaves your team to decide what matters. Here every change is compared with what was there last time, repeats and known noise are filtered out, and a tester who knows your environment reviews every finding before it reaches you: validated by hand and written up with reproduction steps and a fix.
How often do you scan, and will it disrupt anything?
We agree the cadence with you. Light checks run anywhere from weekly to several times a day, and a full discovery pass from quarterly to every two weeks. The most frequent settings are more likely to trip rate limits or your own monitoring, so we only use them by agreement. Every scan also waits in proportion to how long the last one took, so a slow network is never scanned most of the day.
Where do people come in, if the checks are automated?
Where judgment matters. Automation handles the volume, comparing each scan with the last and filtering out repeats and known noise. Testers review every finding, validating it by hand before it is written up and reaches you. On applications, testers also come back by hand to new or changed functionality, or areas you name, from a bucket of hours scoped up front and written into the quote, so you know what you are buying.
What do we hear, and when?
Confirmed findings are published to your portal as they are approved, with an email to the people on your team who subscribe, exactly as during a regular test. If something severe affects you, such as an actively exploited vulnerability in software we have seen on your systems, a person on our team tells you directly. You can ask about any finding on the finding itself and get an answer from the testers on the engagement.
What does it cost?
It is scoped like any engagement: how much is in scope, how often it is checked, and how much manual testing is included. Annual programs are covered in our penetration testing cost guide. If a single annual test is all your situation calls for, we will say so.
Budgeting for a program? The cost guide covers annual programs alongside single tests.
Stop finding out a year later
Tell us what changes in your environment and how often. We will suggest a cadence and scope that fit, or tell you an annual test is enough.