continuouspentest

A vendor-neutral reference on continuous penetration testing and what a subscription has to deliver before it counts.

Scope a program

Guides

Continuous penetration testing guides

Continuous penetration testing guides: scanning and bug bounty comparisons, significant changes, testing cadence and evidence for auditors.

Start with the definition if the term is new to you, or go straight to the change triggers if you already run a program and need to defend its frequency to an assessor.

All guides

  1. What continuous testing is The activity has a precise definition. The delivery model does not. Here is what is actually defined, what changes when testing repeats, and what the PTaaS label guarantees on its own. 10 min read
  2. Testing vs scanning vs bounty Three controls, three different questions, three different contracts. What each one is genuinely good at, what NIST and CISA record about their limits, and how to stop buying one while believing you bought another. 10 min read
  3. Testing after change Four frameworks require testing after significant change, and none of them defines “significant” for you. How to build the trigger list, decide what each trigger tests, and record the decision when you decide not to test. 10 min read
  4. Evidence for auditors Testing that leaves no record is an expense, not a control. The nine artifacts a program should produce, which framework asks for each one, and why the retest record is the one most programs are missing. 10 min read