Solution
Recurring and Continuous Penetration Testing
Pentesting on the cadence you ship at: recurring engagements, such as quarterly, or continuous testing on a schedule you set. Scheduled scans and agentic pentests run between engagements, and our engineers review what they find and test major releases by hand.
For: Product teams that ship often and are asked for security evidence all year.
Every engagement is quoted after a scoping call, based on what we would actually test. How engagements are priced
What's included
- Recurring manual pentests on a cadence you choose, such as quarterly
- Continuous scheduled scanning of code, dependencies, secrets and IaC
- Agentic pentests of the hosts you verify, on your schedule
- Engineer review of every finding, and manual testing of major releases
- Fixes proposed as pull requests, retested when merged
Related services
Who is recurring pentesting for?
Recurring pentesting is for product teams that ship often and are asked for security evidence all year, not once. A pentest from last spring says little about the code you shipped last week.
It suits teams that already have a pentest report and want the next one to cover what changed, with testing in the months between instead of a gap.
How does the engagement run?
It runs in 6 steps, each agreed with you before it starts.
- 01
Scope and cadence
We agree the applications and hosts in scope, how often the manual pentest runs (quarterly, for example), and when scheduled scans and agentic tests may run.
- 02
Host verification
You verify that you own each host before an agentic pentest runs against it. Nothing you have not verified gets tested.
- 03
Testing between engagements
Scheduled scans cover your code, dependencies, secrets and infrastructure as code. Agentic pentests run against your verified hosts on the schedule you set.
- 04
Engineer review
Our engineers review every finding before it reaches you, and test major releases by hand.
- 05
Manual pentest each cycle
On the agreed cadence our engineers run a manual pentest, and you receive a report for that cycle.
- 06
Fixes and retest
Where the fix is clear, we propose it as a pull request. When your team merges it, we retest.
What do you receive?
- A report for each manual pentest cycle
- Findings between cycles, each reviewed by an engineer
- Fixes proposed as pull requests for your team to approve
- Retest results when fixes are merged
What do we need from you?
- Access to the repositories in scope, for scheduled scanning
- Verified ownership of every host we test
- Your release calendar, so major releases get tested by hand
- An engineer who reviews and merges fix pull requests
Questions
How is this different from an annual pentest?
Testing continues between reports. An annual pentest is a snapshot of one moment; here scans and agentic tests run between manual engagements, and major releases are tested when they ship.
Does automated testing replace the manual pentest?
No. Agents and scanners cover breadth between engagements and our engineers review what they find, but every cycle still includes a manual pentest by our engineers.
What is PTaaS? →Other engagements
Book a call
Book a 30-minute call
Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.
Cyphlon
1:1 Consultation Call
30 min
Google Meet
An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.