Advisory & programsPenetration testing as a service
Penetration Testing as a Service (PTaaS) by Certified Pentesters
Penetration testing as a service (PTaaS) means recurring manual penetration tests and testing after releases, run by 25 certified senior pentesters.
Key facts
- Price
- Quoted individually
- Critical findings
- Reported during testing
- Testers
- OSCP, OSCE, CISSP certified
- Contract
- NDA on request · professional indemnity insurance
Priced in tester-days NDA on request Certified senior pentesters How the test works See a sample report
Recurring manual penetration tests and testing after releases, run by 25 certified senior pentesters, with a retest available after fixes. Quoted individually in tester-days after a scoping call.
What a PTaaS program covers
- Recurring manual tests on an agreed cadence
- A two-part report for every test cycle
Scope, cadence and tester-days agreed in writing after a scoping call, before testing starts. Scoped and quoted per engagement. Priced in tester-days, no hidden fees.
Penetration testing as a service (PTaaS) is a way of buying manual penetration testing as an ongoing program instead of a one-off project: tests repeat on an agreed cadence, after releases and after fixes, so findings keep pace with the systems you change. Pentestica delivers PTaaS as continuous penetration testing by its pentesters, for SaaS, fintech and other organizations that ship changes often and need current evidence for customers or auditors.
Tests are run by our penetration testing team: 25 certified senior pentesters (OSCP, OSCE, CISSP) with 500+ penetration tests behind them. We sign an NDA before testing and carry professional indemnity insurance.
Last updated: October 28, 2026
Key takeaways
- PTaaS is a delivery model, not a separate kind of test: the same manual pentesting, repeated on a schedule.
- Our model is people-led: recurring manual tests, testing after releases, a report for every cycle and a retest available after fixes.
- Scope can include web applications, APIs, mobile apps, cloud (AWS, Azure, GCP) and networks.
- Price: quoted individually in tester-days after a scoping call, with no hidden fees.
Recurring, not one-off
Manual tests repeat on the cadence you agree, plus testing after releases and significant changes.
Quoted in tester-days
Quoted individually after a scoping call, with no hidden fees.
A report every cycle
Executive Summary and Technical Report with exploitation evidence and step-by-step remediation.
Retest after fixes
A retest is available after fixes; whether it’s included depends on the engagement.
What is penetration testing as a service (PTaaS)?
PTaaS is penetration testing delivered as a recurring service rather than a single engagement. The testing itself doesn’t change: a certified tester attacks your application or infrastructure the way a motivated attacker would and proves impact with evidence. Only the rhythm changes: instead of one test a year, testing follows your releases, significant changes and the fixes your team ships.
Continuous penetration testing, pentest as a service and PTaaS describe the same idea. It exists because of a limit every one-off test shares: the UK National Cyber Security Centre notes that a penetration test “can only validate that your organisation’s IT systems are not vulnerable to known issues on the day of the test” (NCSC penetration testing guidance). Code and cloud configuration change every week, and last spring’s report doesn’t describe them.
PTaaS isn’t a scanner on a subscription. Scanning has its place, but a scan can miss authorization and business logic flaws because the server’s response looks technically correct. The difference is covered in penetration testing vs vulnerability scanning.
Know what you want tested?
Send us your scope and how often you release, and get the test cadence, tester-days per cycle and a price in writing. Prefer to compare single tests first? See our prices.
What does a people-led PTaaS program include?
Pentestica’s PTaaS is people-led: our pentesters plan, run and report each test against a scope and schedule agreed in writing. Each cycle gives you the following.
- Recurring manual tests on the cadence agreed in the scoping call.
- Testing after releases and significant changes, scoped to what changed and what it touches.
- Critical findings reported during testing to the contact person you name, without waiting for the final report.
- A two-part report for every cycle: an Executive Summary for management and a Technical Report for IT, with exploitation evidence and step-by-step remediation.
- A retest available after fixes, with each finding marked fixed, partially fixed or still present.
Each finding is written so your developers can reproduce it and move it into their own tracker.
How does continuous penetration testing work at Pentestica?
1. Scoping Call and Cadence
We agree the scope, user roles and test accounts, the systems that must not be disrupted, testing hours and the cadence: per release, on a fixed calendar or after significant changes.
2. Baseline Test
The first cycle is a full manual pentest of the agreed scope. A typical pentest takes 1–3 weeks of testing plus a few days for the report.
3. Critical Findings During Testing
A confirmed critical issue is exploited only as far as needed to show impact, then sent to your named contact with the affected system, evidence and the most important step to reduce the risk.
4. Report for Every Cycle
Before each report goes out, findings are checked again for reproducibility, impact and severity, so real risk stands apart from informational notes.
5. Retest After Fixes
A retest is available after fixes. It replays the original attack path and, for access control flaws, checks similar endpoints and roles, not just the one parameter that was patched.
6. Release and Change Tests
Before the next cycle we review the scope again, then test what changed: new features, new endpoints, new cloud resources and the areas they touch.
PTaaS vs annual penetration testing vs automated scanning
PTaaS keeps the depth of a manual pentest and adds frequency; an annual pentest has depth without frequency, and scanning has frequency without manual depth.
| Pentestica PTaaS | Annual pentest | Automated scanning | |
|---|---|---|---|
| Who tests | Certified pentesters, by hand | Certified pentesters, by hand | Software |
| When | Agreed cadence and releases; retest available after fixes | Once a year or before an audit | As often as it’s scheduled |
| Authorization and business logic | Tested across roles and tenants in each cycle’s scope | Tested once | A scan can miss them when the response looks valid |
| Chained attack paths | Shown with evidence | Shown with evidence | Not what a scan is built for |
| Fix verification | Retest available after fixes | Retest available after fixes | Rescan of the same check |
| Output | Two-part report per cycle | One report | Automated list of findings |
| Fits best | Teams that ship often or need current evidence | Stable systems, one-time requirements | Known issues between manual tests |
The models work together: scans catch known issues between cycles, and manual tests find what scans can’t. If you’re still deciding on an interval, see how often to run a penetration test.
What does recurring testing catch that a one-off test misses?
Recurring testing catches what changed after the last report: new endpoints, retired features nobody switched off, and fixes that closed one path but left another open.
In API tests, we’ve found an older endpoint that had dropped out of the current documentation but still answered requests, and it returned more data than the endpoint that replaced it. A scan that follows the API documentation would probably never have checked it. It was switched off once nobody could find anything still using it. A one-off test only catches leftovers like this if they’re already there on the test day.
Fixes need the same attention. A retest shouldn’t only check that one server response changed: we replay the original attack path and look for another way to exploit the same problem. PCI SSC guidance makes the same point: “the tester should perform a retest to validate the newly implemented controls mitigate the original risk” (PCI SSC Penetration Testing Guidance).
What can a PTaaS program cover?
A PTaaS program can include any of our penetration testing services. A good first cycle covers the systems that change most often.
Web Applications
Login, sessions, roles and business logic, aligned with OWASP WSTG. See web application penetration testing.
APIs
Object and function level authorization, tokens and tenant isolation, checked for every role. See API penetration testing.
Mobile Apps
iOS and Android builds, data on the device and the backend API behind each release. See mobile app penetration testing.
Cloud
AWS, Azure and GCP: IAM roles, exposed storage, secrets and the paths between accounts. See cloud penetration testing.
Networks
The external perimeter, the internal network and Active Directory. See infrastructure penetration testing.
Compliance Scope
Systems in your PCI DSS, SOC 2, ISO 27001, HIPAA or NIS2 scope, tested as evidence for your assessor. We don’t certify compliance.
When does continuous penetration testing make sense?
Continuous penetration testing makes sense when a yearly report can’t keep up with your changes, or when customers and regulators want current evidence.
You Release Often
Frequent releases add endpoints and change authorization rules faster than an annual test can follow.
Customers Review Your Security
Customer security reviews often ask for a recent pentest report, and a SOC 2 auditor may review one as evidence. Pentestica doesn’t issue SOC 2 reports or attestations.
You Handle Card Data
PCI DSS v4.0.1 requirement 11.4 calls for penetration testing at least every 12 months and after significant changes, and service providers that use segmentation test it at least once every six months and after changes to segmentation controls (11.4.6). See the PCI SSC document library.
DORA or NIS2 Applies
DORA Articles 24–25 require financial entities, other than microenterprises, to run a digital operational resilience testing program, and NIS2 Article 21(2)(f) asks for “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”. NIS2 doesn’t set a fixed testing interval; a recurring program is one way to keep the evidence current. See NIS2 penetration testing; TLPT under DORA Articles 26–27 is a separate exercise.
A Big Change Is Coming
A cloud migration, a new payment integration or a rebuilt login flow deserves a test before it goes live, not at the next annual date.
Why trust Pentestica with recurring access to your systems?
A PTaaS program gives one team repeated access to your systems, so these are the facts worth checking first.
NDA Before Testing
We sign an NDA before testing starts.
Professional Indemnity Insurance
We carry professional indemnity insurance.
25 Certified Senior Pentesters
OSCP, OSCE and CISSP certified, with 500+ penetration tests behind the team.
Recognized Methods
Testing aligned with OWASP WSTG, PTES and NIST SP 800-115.
Case Study: API Test Before a Fintech Launch
In a grey box API test for a neo-bank preparing to launch a new mobile application, we found an IDOR that let one user view another user’s full transaction history and a race condition in the transfer endpoint. Critical findings were flagged during testing, the client’s development team patched the IDOR and race condition vulnerabilities within 48 hours, a retest confirmed the fixes were effective and the app launched on schedule. Read the fintech API case study.
What do you receive from each test cycle?
Each cycle produces a report in two layers. The Executive Summary shows management the main risks, attack paths and business impact. The Technical Report lists every vulnerability with exploitation evidence and step-by-step remediation, so developers can reproduce and fix it.
Retest results are recorded per finding as fixed, partially fixed or still present. See a sample penetration test report.
How is PTaaS priced?
PTaaS is quoted individually, in tester-days, after a scoping call, with no hidden fees. Tester-days depend on what each cycle covers, how many user roles and tenants need checking, and how often you want testing.
For example, a SaaS app with about 40 API endpoints, three user roles, an admin panel, MFA and a payment integration might need around 5–7 tester-days for a full test. That’s an example, not a price list. Single-test ranges are on our penetration testing pricing page.
What can you check before you hire us?
Three things you can verify for yourself: what the report looks like, who does the testing, and how a real engagement went.
What does the report look like?
Every report opens with an executive summary for management, then one page per finding: severity and CVSS score, evidence of exploitation, business impact and step-by-step remediation. A retest is available after fixes, and the updated report shows which findings are closed. Browse our sample pentest report with every section explained.
Who tests your systems?
Senior pentesters from our team of 25, holding hands-on offensive security certifications such as OSCP and OSCE alongside CEH, CISA, CISM and CRISC.
Our case studies
How we tested a FinTech API, a medical SaaS platform and a retail web store: scope, findings, fixes and the retest.
Frequently asked questions
Is PTaaS the same as continuous penetration testing?
Mostly, yes. Both describe penetration testing repeated over time instead of one project a year. Some offers use “continuous” for automated scanning; at Pentestica both terms mean recurring manual testing by our pentesters.
How often should a PTaaS program test?
There’s no single right interval. Test after significant changes and at least as often as your regulators or customers expect; PCI DSS, for example, asks for at least every 12 months and after significant changes. Teams that release often can tie testing to their release cycle.
How are PTaaS findings delivered?
Every cycle ends with a written Executive Summary and Technical Report. Critical findings go to your named contact during testing, and retest results are recorded per finding as fixed, partially fixed or still present. If you need a particular delivery format, raise it in the scoping call.
Is the retest included in PTaaS?
A retest is available after fixes. Whether it’s included in the price depends on the engagement and is agreed in the quote.
Can we start with a single pentest?
Yes. A program can start with one full test of your main application, with later cycles agreed once you’ve seen the first report.
Is PTaaS priced per month?
PTaaS is quoted individually, in tester-days, after a scoping call, with no hidden fees. Tester-days follow what each cycle covers and how often you want testing, so ask about payment terms when you request the quote.
Fixed-price quote
Plan your penetration testing as a service program
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees.
See a sample report first (18-page PDF, no email required)
Quoted individually in tester-days after a scoping call, with no hidden fees. All prices
What happens after you send it
- Tell us what to test Send the applications, APIs, cloud accounts or networks you want tested, how often you release, your first deadline and any compliance requirement.
- Get a written scope and price We reply by email with scoping questions or a fixed quote in tester-days.
- Test, report, retest Every cycle ends with an Executive Summary and a Technical Report. Critical findings are reported during testing. A retest is available after fixes.
- OSCP, OSCE and CISSP certified testers
- 500+ penetration tests
- Aligned with OWASP WSTG, PTES and NIST SP 800-115
- Executive summary and technical report