Continuous Penetration Testing: Models, Cadence and Cost

The term describes an outcome, testing that keeps up with change, rather than a method. In practice you will be offered one of three models:

• PTaaS (penetration testing as a service). Human testers working through a platform: you book tests, see findings as they are found, talk to testers and get retests within a window. Cobalt, Synack, HackerOne, NetSPI, Bishop Fox and BreachLock sell this model, often with automation and now AI agents added.
• Autonomous continuous testing. Software that runs the attack itself, on a schedule, without a tester per run. Horizon3.ai NodeZero, Pentera and XBOW are examples, and so is Zero Hunt. See autonomous penetration testing and AI pentesting agents.
• Hybrid. A platform runs automated or AI-driven testing continuously and human testers verify findings or test what the software cannot.

Related terms overlap: continuous automated red teaming (CART) usually means the same idea applied to the external surface, and Gartner's Adversarial Exposure Validation groups automated pentesting with breach and attack simulation.

If you searched for the OWASP Continuous Penetration Testing Framework: the project page exists, but it only states an intention to standardise the practice, and its repository has not changed since 2022. There is no framework document to follow.

• Change. Every new server, firewall rule, cloud account or software release can open a path that last year's report never saw.
• New vulnerabilities. Edge devices, VPNs and file-transfer servers keep getting critical CVEs that are exploited within days of disclosure. A test in March says nothing about a CVE published in June.
• Drift. Fixes get undone, temporary exceptions become permanent, and credentials get reused.
• Proof of remediation. Without a retest, a closed ticket is a claim, not evidence.

None of this makes the annual human-led test useless. It makes it the deep check, not the only one.

Most rules set a minimum and add a trigger for change, which is the part continuous testing answers:

• PCI DSS v4.0.1, requirement 11.4: internal and external penetration tests at least once every 12 months and after any significant infrastructure or application upgrade or change. See PCI DSS 11.3 and 11.4.
• DORA, art. 24(6): appropriate tests at least yearly on all ICT systems and applications supporting critical or important functions; art. 26 adds TLPT at least every three years for the entities identified. See DORA penetration testing beyond TLPT.
• NIS2, art. 21(2)(f): policies and procedures to assess the effectiveness of risk-management measures, with no frequency set. In Italy, ACN's Allegato 2 requires essential entities to run vulnerability assessment and/or penetration testing periodically and before go-live. See NIS2 obligations and deadlines.
• NIST SP 800-53 Rev. 5, CA-8: penetration testing at an organisation-defined frequency.

The pattern: a yearly floor, and tests after significant change. If changes happen every week, so should tests.

1. 1External attack surface: weekly. Internet-facing services change fastest and are attacked first.
2. 2Internal network and Active Directory: monthly, from an assumed-breach position with an ordinary user account (gray box).
3. 3After every significant change: new site, merger, major release, firewall or identity-provider change.
4. 4After a relevant KEV listing: test the affected systems while the patch is pending, and again after it. See the KEV emergency patch playbook.
5. 5Before go-live of a relevant system, as Italian NIS2 rules require of essential entities.
6. 6After every fix: re-run the same test to close the finding with evidence.
7. 7Once a year: a human-led test of business logic, custom applications and anything the regulation reserves for qualified testers.

Public prices are rare, but the models are clear and decide what continuous testing will cost you:

• Credits or tester hours (PTaaS). You buy a bank of testing time. Cobalt, for example, sells credits worth eight pentest hours each. Testing more often means buying more credits.
• Subscriptions per test window. A fixed number of tests or a testing period per year, sometimes with continuous monitoring between them.
• Yearly licence (autonomous platforms). Priced by assets, IPs or sites, with unlimited runs. Here the cost of testing weekly is the same as testing monthly, which is what makes a high cadence affordable.

When you compare quotes, price the cadence you need, not the one in the brochure: 52 external runs and 12 internal runs a year, plus retests. More in automated pentesting cost.

• Who or what runs each test? A person, software, or software with a person checking the results?
• What does continuous mean in the contract? Runs per month, retests included, testing after changes on request?
• Can it test the internal network and Active Directory, or only internet-facing assets?
• Where do findings, credentials and evidence go? Vendor cloud, a region of your choice, or your own premises?
• How is scope enforced and who can stop a test at once?
• What evidence comes with each finding, and does a retest prove the fix?
• Which regulations do reports map to, and does that include the ones you answer to?

The evaluation guide turns these into a pilot plan.

What is the difference between continuous penetration testing and PTaaS? PTaaS is a delivery model: human testers on a platform, bought as a subscription. Continuous penetration testing is the goal of testing as often as things change; PTaaS is one way to get there, autonomous testing software is another.

Is continuous penetration testing the same as vulnerability scanning? No. A scanner lists what might be vulnerable. A penetration test, continuous or not, tries to exploit it and chain findings into attack paths. See vulnerability assessment vs penetration testing.

Does continuous testing replace the annual pentest? For breadth and frequency it can; for depth on business logic and custom applications, and where a rule requires qualified testers or TLPT, keep a human-led test.

Is there a standard for continuous penetration testing? No. The OWASP project with that name has published nothing since 2022. For autonomous platforms, the OWASP Autonomous Penetration Testing Standard covers scope, safety, human oversight and evidence.

How does Zero Hunt do continuous penetration testing? Zero Hunt is an autonomous AI red team for networks and infrastructure on an on-premise appliance with its own models, so no customer data leaves it. Campaigns run once, daily, weekly, monthly or on a custom schedule, in black-box or gray-box mode, and an operator can start one after a change. A re-run after a fix shows closure with signed evidence. Five autonomy levels decide which actions wait for an operator, scope is validated on tool calls and in generated scripts, and findings map to 34 compliance frameworks worldwide. Zero Hunt publishes no benchmark numbers yet; its evaluation methodology is in preparation.