What is PTaaS (penetration testing as a service)?

PTaaS, or penetration testing as a service, is penetration testing delivered as an ongoing service rather than a one-off project. Instead of one test a year and a PDF at the end, testing runs on a schedule or on demand, findings arrive as they are confirmed, and retests happen when you ship a fix.

Most PTaaS offerings combine automated testing, which covers breadth between engagements, with human testers, who verify findings and test what automation cannot judge. How much of each you get varies a great deal from one provider to the next, and it is the first thing to ask about.

How is PTaaS different from a traditional pentest?

The main difference is timing. A traditional pentest is a snapshot: a team tests for a fixed window, writes a report and leaves. Anything you ship the following week is untested until the next engagement.

	Traditional pentest	PTaaS
When testing happens	A fixed window, often once a year	On a schedule or on demand
How you get findings	A report at the end	As each finding is confirmed
Retesting	A separate engagement, if at all	When you fix something
Testing between engagements	None	Automated testing, reviewed by people

The depth of each manual test does not have to change. A good PTaaS engagement still includes manual testing by engineers; it adds coverage between those tests instead of replacing them.

Who is PTaaS for?

It suits teams that ship often and need security evidence all year. If you release weekly and enterprise customers ask about your security in every renewal, an annual report goes stale quickly. A team that changes its product twice a year may be well served by a traditional test.

What should you check before buying PTaaS?

Ask how the service works in practice, not what the platform shows in a demo:

1. Who tests, and how much is manual? Automated findings need a person to confirm them before they reach you.
2. What is tested between manual engagements? Scheduled scans, automated pentests, or both, and against which hosts.
3. How are findings verified? Each finding should come with evidence and a proof of concept, not just a scanner rule name.
4. Is the report audit-ready? If you need it for SOC 2, ISO 27001 or a customer review, check that it states scope, dates and method.
5. How do retests work? Find out whether a retest is included each time you fix something.

Does PTaaS replace a manual pentest?

No. Automated testing finds a lot, but it cannot reliably judge business logic, authorisation between users, or how several small issues chain into a serious one. Those still need an engineer. PTaaS changes how often you test and how you receive results; the manual work remains.

How does Cyphlon deliver PTaaS?

Our recurring and continuous pentest engagement is our version of it. Manual pentests run on a cadence you choose, such as quarterly. Between them, scheduled scans cover your code, dependencies, secrets and infrastructure as code, and agentic pentests run against hosts you have verified. Our engineers review every finding, test major releases by hand, and propose fixes as pull requests that are retested when merged.

If you need a single test first, start with a compliance pentest.