Skip to content

Continuous pentesting with one manual test day every month

One manual test day every month, all year round.

Continuous pentesting is a manual pentest spread over the year. Every month, a tester spends one test day on your releases, for example on your web app, and retests every fix. Findings are tracked in one running report. It costs a fixed €590 per month, with no minimum term.

€590 per month · 1 manual test day per month

See my fixed price
See my fixed price

Prefer to talk first? Book a call

Release calendar 1 test day per month MoTuWeThFrSaSu 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Release Test day Finding Retest
One test day a month, placed right after your release.
  • 1 test day per monthused for your releases
  • No minimum termcancel monthly
  • One running reportall findings in one place
  • Free retestof every fix

Manual, every month. Not AI-assisted.

How it differs from the monthly AI-assisted pentest: here, a tester tests by hand for one day every month. There, an AI-assisted run happens every 2 weeks.

See the Monthly AI-assisted pentest.

Who it’s for

  • Teams that want their web app tested by hand every month, all year round
  • Companies that release often and want each release tested before or right after go-live
  • Clients who had a one-off pentest and want new releases tested until the next one

What you get every month

Your releases

  • 1 manual test day per month, used for your releases
  • Every release tested before or right after go-live
  • Save unused days within a calendar quarter for a big release

Every month

  • Check of your external attack surface
  • Findings tracked in one running report
  • Questions answered between releases

How continuous pentesting works. One test day, every month.

Release by release, with the same tester every month.

manual test day per month
1
test days a year
12

  1. Phase 1

    Scope & start date

    Monthly price and start date online. A call, if you like.

    You pick the date

  2. Phase 2

    Monthly test day

    One manual test day, used for your releases.

    Every month

  3. Phase 3

    Release checks

    Each release tested before or right after go-live.

    Per release

  4. Phase 4

    Running report

    All findings tracked in one running report.

    Ongoing

  5. Phase 5

    Free retest

    Every fix tested again at no charge.

    Every fix

How it works

How continuous pentesting works

One manual test day every month

Every month, a tester spends one test day on your systems, for example on your web app. The day goes to whatever you release: each release is tested before or right after go-live.

Save days for a big release

Unused test days carry over within the calendar quarter. Save them for a big release and use them together.

One running report

Findings are tracked in one running report. Every fix is retested free of charge, and your questions are answered between releases.

Your external attack surface, every month

Each month we also check your external attack surface.

Monthly, with no minimum term

You pay a fixed price per month and can cancel monthly. Paying a year upfront costs less, see the price below.

One fixed monthly price. No minimum term.

Continuous pentesting

One manual test day every month, used for your releases. Fixed monthly price, cancel monthly.

€590 per month

  • 1 manual test day per month, used for your releases
  • Save unused days within a calendar quarter for a big release
  • Every release tested before or right after go-live
  • Free retest of every fix
  • Questions answered between releases
  • Findings tracked in one running report
  • Monthly check of your external attack surface

Cancel monthly. 10% off when you pay a year upfront: €6,372 per year. Unused test days carry over within the calendar quarter and expire at its end.

See my fixed price

Services exclusively for businesses.

What you get

  • Findings tracked in one running report
  • Free retest of every fix
  • Monthly check of your external attack surface
  • Questions answered between releases
See my fixed price

Prefer to talk first? Book a call

Pentest report · Admin & Söhne GmbH · MC-2026-028
Risk: Medium CVSS 3.1 · 5.4 Open · retest included

After the release, deactivated users can log in again

portal.admin-soehne.example · customer portal login

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

New since last month’s test day: after the move to a new login service, accounts that business customers had deactivated, for example of staff who left, can sign in again. They see their former company’s orders and prices and can change open orders.

Steps to reproduce

  1. Deactivate a test user in the customer portal, as a business customer would.
  2. Sign in with that test user after the latest release.
  3. The sign-in works, and the former company’s orders are visible.
Last month:  deactivated test account → "Account disabled"
This month:  deactivated test account
  → signed in, company orders visible
Change since last test day: new login service

Business impact

Former employees, perhaps now at a competitor, see current orders and prices. Caught within weeks, not at next year’s pentest.

Remediation

Carry the “deactivated” status over to the new login service and block those accounts there. Check on every request that the account is still active. Add a test with a deactivated account to the release checks.

OWASP Top 10 2021: A07 Identification and Authentication Failures · CWE-613 (Insufficient Session Expiration) · CWE-285 (Improper Authorization)

Frequently asked questions

How much does continuous pentesting cost?
A fixed €590 per month for 1 manual test day per month. If you pay a year upfront, you get 10% off, so a year costs €6,372.
Is there a minimum term?
No. You can cancel monthly.
How is this different from the monthly AI-assisted pentest?
Continuous pentesting is a manual test day by a tester every month. The monthly AI-assisted pentest is an AI-assisted run every 2 weeks, with every finding verified by the tester.
What if a release needs more than one day?
Unused test days carry over within the calendar quarter, so you can save them for a big release. They expire at the end of the quarter.
How is this different from a one-off pentest?
A one-off pentest tests your system once, at a fixed price for its scope. Continuous pentesting spreads manual testing over the year, so new releases are tested as they ship.

One-off manual pentests

Continuous pentesting: your price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call