A maintained scope
Your estate tracked rather than re-described every year. New assets are noticed, and an asset leaving the estate stops being tested.
Offensive Security
An annual pentest tells you what was true in March.
Most organisations test once a year, deploy four hundred times, and describe the result as their security posture. Continuous testing closes the gap between when something breaks and when anybody finds out.
LiveFindings as they are confirmed
IncludedUnlimited retests
VerifiableCertificate that stays current
HumanEvery finding verified
What the annual model actually buys you
The annual penetration test exists because it satisfies a requirement. It produces a PDF in March, the findings are fixed over six weeks, and for the remaining ten months nobody tests anything. In that time you ship hundreds of changes, add infrastructure, onboard suppliers and expose new endpoints. The report on file describes a system that no longer exists.
Continuous testing is not "the same test, more often" — running an identical scan twelve times produces eleven reports nobody reads. It is a subscription in which the scope is maintained rather than re-scoped: your estate is tracked, changes trigger testing, scheduled assessments run against the things that matter, and you can ask for an unscheduled one the week before a release without raising a new purchase order.
The part that changes how it feels day to day is delivery. Findings reach you as they are confirmed, not in a document three weeks later — so remediation starts on the day the weakness is found, while the engineer who wrote the code still remembers it.
Coverage
What the subscription includes
The testing, and the delivery machinery around it.
Scheduled assessments
On a cadence that matches the asset — a payment path is not tested on the same rhythm as a marketing site.
On-demand testing before a release
Ask for one. No new statement of work, no procurement cycle, no three-week lead time.
Findings delivered live
They appear in the portal as they are confirmed. You do not wait for the report to start fixing.
Unlimited retests
Every fix verified. A finding is closed when a retest proves it, not when somebody ticks a box.
Human verification, always
Automation gives coverage; a person establishes what is real and what it is worth. Nothing reaches you unverified.
Findings mapped to your controls
Each one lands on the clauses it affects across every framework you track — and flags any control you had marked as working that it just contradicted.
A verifiable certificate
A public link, not a PDF, that reflects where remediation actually stands and updates as it moves.
Approach
How it runs
Set the scope once, then it keeps going.
-
01 · Scope and authorise
What is in, what is explicitly out, and written authorisation to test it. Nothing runs without that, and the authorisation is renewable rather than one-off.
-
02 · Baseline assessment
A full first pass, so everything afterwards is measured against something real.
-
03 · Continuous operation
Scheduled assessments, change-triggered testing, and whatever you ask for in between. Findings arrive as they are confirmed.
-
04 · Remediate and retest
Fixes verified as they land. The register is the record, and it is always current.
-
05 · Report when you need one
Point-in-time reports for auditors, boards and customers — generated from the live register rather than assembled by hand.
Deliverables
What you actually receive.
The report is the product. If it cannot be acted on by a developer and understood by a director, we have not finished.
A live findings register
Always current, with severity, status, owner and the retest verdict on each item.
Point-in-time reports on demand
For an auditor, a board pack or a customer, generated from the register.
A verifiable assessment certificate
A shareable link that reflects where remediation stands, not where it stood the day it was issued.
Control impact per assessment
Which of your framework controls each assessment touched, and which it contradicted.
A named engagement lead
The person who scopes it is the person who delivers it.
Is this for you?
Talk to us if any of these are true.
If none of them are, say so on the call and we will tell you honestly whether this is the right piece of work — or point you at the one that is.
Book a scoping call- You test annually and deploy weekly.
- A customer or auditor asks for evidence of testing more often than once a year.
- Your last report was six months ago and half of it has been fixed, but nothing says so.
- Raising a purchase order takes longer than the test you need before a release.
- You want remediation to start when a weakness is found, not when the report arrives.
How we work
Six steps, and no surprises.
The same engagement model applies to every piece of work we take on, so you always know what happens next.
01
Scope
A 30-minute call, then a written scope: what is in, what is out, what we need from you and what it costs. Nothing starts before you sign it.
02
Authorise
Rules of engagement, testing windows, escalation contacts and a signed authorisation. Out-of-hours windows where production cannot take the load.
03
Test
Automated coverage first, then manual testing where judgement is required. Critical findings are reported the day we confirm them, not at the end.
04
Report
One report a developer can act on and an executive can read, with evidence, reproduction steps, business impact and a fix for every finding.
05
Remediate
A walkthrough call with your engineers. We answer questions on the fix, not just the finding.
06
Retest
A free retest cycle to confirm the fixes hold, and a clean summary you can hand to a customer, auditor or board.
Questions
Continuous Pentesting — answered.
The questions clients actually ask during scoping. If yours is not here, ask it directly.
How is this different from a vulnerability scanner on a schedule?
A scanner produces candidates. This produces verified findings: a person establishes whether each candidate is real, whether it is reachable, and what it is worth in your environment. The scanning is the cheap part and we do plenty of it — what you are subscribing to is the judgement applied to the output, and the delivery machinery around it.
Is a continuous subscription accepted for compliance?
Generally yes, and often better than an annual test, because continuous testing produces dated evidence throughout the year rather than one artefact that ages. What matters to an assessor is scope, competence, and findings tracked to closure and retested — all of which this produces as a by-product. If your auditor has a specific format in mind, tell us during scoping.
What does "live findings" actually mean?
When an assessment is running, confirmed findings appear in your portal as they are verified rather than being held back for the report. On a multi-day engagement that routinely means the first fix is deployed before the testing has finished.
Are retests really unlimited?
Within your subscribed scope, yes. Charging for a retest creates an incentive we do not want: it makes closing a finding cost money, which is exactly backwards. A finding is closed when a retest proves it is closed.
Can we still get a traditional report?
Yes, on demand and as often as you like. The difference is that it is generated from a register that is always current rather than assembled at the end of an engagement — so the report and reality do not drift apart between the last day of testing and the day somebody reads it.
What happens if we add a new application mid-subscription?
It goes into scope, gets authorised, and gets a baseline assessment. That is the point of a maintained scope rather than an annual one — the alternative is an application that is in production for eleven months before anybody tests it.
Next step
Get a written scope and a fixed price.
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.