Penetration Testing as a Service: Is PTaaS Worth It?
Penetration testing as a service, usually shortened to PTaaS, is a subscription model where a testing provider runs penetration tests against your environment on an ongoing basis and delivers findings through a platform rather than as a single report at the end. It suits businesses whose applications change every few weeks. If your environment is stable and you release a few times a year, one properly scoped annual penetration test will usually give you more security value for the same spend.
That answer holds for most Australian businesses between 2 and 100 staff. The rest of this guide explains what PTaaS actually includes, where it beats a traditional engagement, where it does not, and what to ask a provider before you commit to a subscription.
What is penetration testing as a service?
Penetration testing as a service is a delivery model, not a different kind of security testing. Human testers still attempt to break into your systems the way an attacker would. What changes is how the work is packaged. Instead of buying a fixed engagement with a start date, an end date and a PDF report, you buy a subscription that entitles you to testing across a period, with findings published to a portal as they are discovered.
Most PTaaS platforms offer three things a traditional engagement does not: findings that appear during the test rather than weeks afterwards, a dashboard that tracks remediation status over time, and the ability to request a retest without raising a new purchase order. Some also integrate with issue trackers such as Jira so findings land directly with the developers who will fix them.
The term is used loosely. Some providers sell genuine ongoing manual testing. Others sell an automated scanning platform with a small amount of human validation and call it PTaaS. The difference matters a great deal, and it is the single most useful question to ask when you compare quotes.
How is PTaaS different from a traditional penetration test?
A traditional penetration test is a bounded engagement. You agree a scope, a testing window and a fee. Named testers work through that scope, and you receive a report with findings, risk ratings and remediation advice. Penetration testing as a service spreads that same work across a subscription period and delivers it continuously.
The table below sets PTaaS against a scoped penetration test and against automated vulnerability scanning, which is a third thing again and is often confused with both.
| PTaaS | Scoped penetration test | Vulnerability scanning | |
|---|---|---|---|
| Who does the work | Testers working through a platform, findings released in stages | Named testers on a defined engagement | An automated tool, with no human testing |
| When you get results | Continuously across the subscription | Once per engagement, plus a retest | Every time the scan runs |
| Finds business logic flaws | Yes | Yes | No |
| Finds known missing patches | Yes | Yes | Yes |
| Commitment | Annual subscription | Fixed scope and fixed fee | Monthly or continuous tooling |
| Best suited to | Environments that change every few weeks | A defined scope tested thoroughly once or twice a year | Patch and configuration hygiene between tests |
If you are still deciding between human testing and automated scanning at all, our guide to penetration testing versus vulnerability scanning covers that distinction in more detail.
When is penetration testing as a service worth paying for?
Penetration testing as a service earns its subscription in a narrow set of circumstances. The clearest signal is release frequency. If you ship code to production weekly, an annual penetration test only ever describes a version of your product that no longer exists by the time you read the report. Continuous testing closes that gap.
Three other conditions make PTaaS a reasonable buy for an Australian business:
- You have someone who can act on findings within days. A stream of findings nobody triages is worse than a single report someone reads, because the subscription creates a false sense of coverage.
- Enterprise customers ask for testing evidence more than once a year, which is increasingly common in SaaS procurement.
- Your attack surface genuinely changes. New services, new integrations and new customer facing endpoints appearing every month is a different risk profile from one web application that has looked the same for two years.
When should you skip PTaaS and book a scoped test instead?
Skip penetration testing as a service if your environment is stable, if you have no capacity to remediate continuously, or if you are buying testing primarily to satisfy an auditor or a customer. In all three cases a scoped penetration test does the job better.
The reason is depth. A subscription spreads a finite number of tester hours across a year. A scoped engagement concentrates them. For a business with one web application, one API and a corporate network, concentrated effort against a well defined scope tends to surface deeper issues than the same hours drip fed across twelve months.
There is also a budget argument that providers rarely raise. A subscription commits you to a recurring cost whether or not you use it. A fixed engagement lets you spend the difference on fixing what the test found, which is where the actual risk reduction happens. Our guide to how often you should run a penetration test sets out the usual cadence for Australian businesses.
Does PTaaS satisfy ISO 27001 and SOC 2 evidence requirements?
Both ISO 27001 and SOC 2 expect evidence that you test your systems for technical vulnerabilities and act on what you find. Neither standard prescribes a delivery model, so penetration testing as a service and a traditional engagement are both acceptable, provided the evidence is complete.
What auditors look for is consistent across either model: a defined scope, evidence the testing happened, findings with risk ratings, and proof that findings were remediated or formally accepted. A PTaaS platform can make this easier because remediation tracking is built in. It can also make it harder if the platform exports findings in a format that does not clearly show a point in time result the auditor can sample.
Ask any prospective provider for a sample report before you sign, and check it against what your auditor expects. Our guides to penetration testing for ISO 27001 and penetration testing for SOC 2 set out what each auditor will want to see.
Is DAST the same as penetration testing as a service?
No. Dynamic application security testing, or DAST, is automated tooling that probes a running application for known classes of vulnerability. Penetration testing as a service uses human testers, even though it is delivered through a platform. The two are frequently marketed together, which is where the confusion starts.
A DAST tool is good at breadth and repetition. It will find missing security headers, obvious injection points and out of date components across a large application quickly and cheaply. It cannot reason about your business. It will not work out that a user on a trial plan can call an administrative endpoint by changing a numeric identifier, because that requires understanding what your application is for.
If a provider describes their PTaaS offering and you cannot establish how many hours of human testing you receive, you are most likely being quoted a DAST subscription with a report template. That may still be a sensible purchase, but it should be priced as tooling, not as penetration testing.
What should you ask a PTaaS provider before you sign?
Six questions separate a genuine penetration testing as a service subscription from a scanning platform with good marketing. Ask them in writing and keep the answers.
- How many hours of manual testing are included per period, and what happens if you use them early?
- Who are the testers, what certifications do they hold, and are they based in Australia or offshore?
- Is the provider accredited by a recognised scheme such as CREST, and does that accreditation cover the type of testing you are buying?
- Can you export findings as a point in time report that an auditor can sample, and can you see a sample before signing?
- Are retests included, or charged separately once the subscription is running?
- What happens to the platform data and your findings if you do not renew?
Accreditation is worth particular attention. Independent accreditation gives you assurance about tester competence and engagement process that a vendor’s own claims cannot. We have written separately about why CREST accreditation matters in Australia, and about the questions to ask any penetration testing provider before you sign. You can verify a provider’s current accreditation status on the CREST register.
Common questions
What is penetration testing as a service?
Penetration testing as a service is a subscription model for penetration testing. Human testers work against your systems across a defined period and publish findings to a platform as they are discovered, rather than delivering a single report at the end of a fixed engagement. The testing itself is the same discipline. The difference is packaging, pace and how remediation is tracked.
How often should penetration testing be done?
Most Australian businesses run a penetration test annually, and again after any significant change to their environment. Businesses that release software frequently, or that hold sensitive customer data, commonly move to twice a year. Compliance frameworks rarely mandate a fixed interval, but auditors expect a documented rationale for whatever cadence you choose and evidence that you follow it.
When do you need penetration testing?
You need penetration testing when you have systems that other people can reach and something worth protecting behind them. In practice the trigger is usually external: a customer contract requires it, a compliance framework such as ISO 27001 or SOC 2 expects it, a cyber insurer asks about it, or you are about to launch something new that has never been tested.
Is penetration testing a control?
Penetration testing is a detective and assurance activity rather than a preventive control. It tells you whether your other controls work. Most frameworks treat it that way. ISO 27001 addresses it under technical vulnerability management, and auditors assess whether you test, whether you act on results, and whether the scope was appropriate, not whether testing alone protects you.
Do PTaaS subscriptions include retesting?
Some do and some do not. Retesting, where a tester verifies that your fixes actually resolved the finding, is one of the most valuable parts of any engagement and one of the most common exclusions in a subscription. Confirm in writing whether retests are included, how many you get, and how quickly they are turned around after you mark a finding as fixed.
Get an honest answer on what your business actually needs
Siege Cyber is a CREST accredited Australian penetration testing firm. We will tell you when a subscription is worth it and when a single well scoped engagement will serve you better, because a test nobody acts on helps nobody. Learn more about our penetration testing services, or read about vulnerability assessments if regular scanning between tests is what you are after.
Get in touch and we will scope it with you properly.