Why a yearly test is not enough

An annual penetration test answers a precise question: how did the system look on the days it was tested? The next day you may release a new feature, add a supplier or change a setting.

What changes between tests

• New code and new endpoints.
• New people with access, and people who left.
• Newly published weaknesses in components you use.
• Changes in your cloud and network configuration.

A better rhythm

1. A full test when a product is first launched, or after a major change.
2. A retest of what you fix, so findings are closed with evidence.
3. Targeted tests when something important changes.
4. Automated checks in between, for the basics.

This is the idea behind the PTaaS platform: requests, findings and fixes kept in one place, over time. It is also why continuous improvement is the base of everything else we offer.