--- title: "Continuous Pentesting: Monthly Manual Test Day, Fixed Price" url: https://mr-cyber.com/services/continuous-pentesting language: en description: "One manual pentest day every month for your releases, at a fixed €590 per month. No minimum term, cancel monthly. For businesses." --- # Continuous pentesting with one manual test day every month One manual test day every month, all year round. Continuous pentesting is a manual pentest spread over the year. Every month, a tester spends one test day on your releases, for example on your web app, and retests every fix. Findings are tracked in one running report. It costs a fixed €590 per month, with no minimum term. **€590** per month · 1 manual test day per month [See my fixed price](https://mr-cyber.com/quote?service=continuous) [See my fixed price](https://mr-cyber.com/quote?service=continuous) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) One test day a month, placed right after your release. - **1 test day per month**used for your releases - **No minimum term**cancel monthly - **One running report**all findings in one place - **Free retest**of every fix ## Manual, every month. Not AI-assisted. How it differs from the monthly AI-assisted pentest: here, a tester tests by hand for one day every month. There, an AI-assisted run happens every 2 weeks. See the [Monthly AI-assisted pentest](https://mr-cyber.com/services/ai-assisted-pentest#plans). ## Who it’s for - Teams that want their web app tested by hand every month, all year round - Companies that release often and want each release tested before or right after go-live - Clients who had a one-off pentest and want new releases tested until the next one ## What you get every month ### Your releases - 1 manual test day per month, used for your releases - Every release tested before or right after go-live - Save unused days within a calendar quarter for a big release ### Every month - Check of your external attack surface - Findings tracked in one running report - Questions answered between releases ## How continuous pentesting works. One test day, every month. Release by release, with the same tester every month. manual test day per month 1 test days a year 12 1. Phase 1 ### Scope & start date Monthly price and start date online. A call, if you like. You pick the date 2. Phase 2 ### Monthly test day One manual test day, used for your releases. Every month 3. Phase 3 ### Release checks Each release tested before or right after go-live. Per release 4. Phase 4 ### Running report All findings tracked in one running report. Ongoing 5. Phase 5 ### Free retest Every fix tested again at no charge. Every fix ## How it works ## How continuous pentesting works ### One manual test day every month Every month, a tester spends one test day on your systems, for example on your web app. The day goes to whatever you release: each release is tested before or right after go-live. ### Save days for a big release Unused test days carry over within the calendar quarter. Save them for a big release and use them together. ### One running report Findings are tracked in one running report. Every fix is retested free of charge, and your questions are answered between releases. ### Your external attack surface, every month Each month we also check your external attack surface. ### Monthly, with no minimum term You pay a fixed price per month and can cancel monthly. Paying a year upfront costs less, see the price below. ## One fixed monthly price. No minimum term. ### Continuous pentesting One manual test day every month, used for your releases. Fixed monthly price, cancel monthly. €590 per month - 1 manual test day per month, used for your releases - Save unused days within a calendar quarter for a big release - Every release tested before or right after go-live - Free retest of every fix - Questions answered between releases - Findings tracked in one running report - Monthly check of your external attack surface Cancel monthly. 10% off when you pay a year upfront: €6,372 per year. Unused test days carry over within the calendar quarter and expire at its end. [See my fixed price](https://mr-cyber.com/quote?service=continuous) Services exclusively for businesses. ## What you get - Findings tracked in one running report - Free retest of every fix - Monthly check of your external attack surface - Questions answered between releases Pentest report · Admin & Söhne GmbH · MC-2026-028 Risk: Medium CVSS 3.1 · 5.4 Open · retest included ### After the release, deactivated users can log in again portal.admin-soehne.example · customer portal login CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N #### Description New since last month’s test day: after the move to a new login service, accounts that business customers had deactivated, for example of staff who left, can sign in again. They see their former company’s orders and prices and can change open orders. #### Steps to reproduce 1. Deactivate a test user in the customer portal, as a business customer would. 2. Sign in with that test user after the latest release. 3. The sign-in works, and the former company’s orders are visible. ``` Last month: deactivated test account → "Account disabled" This month: deactivated test account → signed in, company orders visible Change since last test day: new login service ``` #### Business impact Former employees, perhaps now at a competitor, see current orders and prices. Caught within weeks, not at next year’s pentest. #### Remediation Carry the “deactivated” status over to the new login service and block those accounts there. Check on every request that the account is still active. Add a test with a deactivated account to the release checks. OWASP Top 10 2021: A07 Identification and Authentication Failures · CWE-613 (Insufficient Session Expiration) · CWE-285 (Improper Authorization) ## Frequently asked questions How much does continuous pentesting cost? A fixed €590 per month for 1 manual test day per month. If you pay a year upfront, you get 10% off, so a year costs €6,372. Is there a minimum term? No. You can cancel monthly. How is this different from the monthly AI-assisted pentest? Continuous pentesting is a manual test day by a tester every month. The monthly AI-assisted pentest is an AI-assisted run every 2 weeks, with every finding verified by the tester. What if a release needs more than one day? Unused test days carry over within the calendar quarter, so you can save them for a big release. They expire at the end of the quarter. How is this different from a one-off pentest? A one-off pentest tests your system once, at a fixed price for its scope. Continuous pentesting spreads manual testing over the year, so new releases are tested as they ship.