Earthshaker Security Book a scan

← All field notes

Field note 17 September 2026 · 9 min read

Continuous Penetration Testing: 90/180/365 Roadmap & CI/CD Checklist

90/180/365 roadmap and checklist to add continuous penetration testing to CI/CD and ASM, pairing automated scans with human verification.

Continuous Penetration Testing: 90/180/365 Roadmap & CI/CD Checklist

Continuous penetration testing replaces the once-a-year audit with an always-on program that mixes automated scanning with human-verified exploit testing, tracking exploitable risk as your applications, APIs, and cloud infrastructure change week to week. It fits organizations shipping code frequently, running API-heavy architectures, or expanding cloud footprint faster than annual audits can keep pace with. If your last pentest report is more than a quarter old, you’re likely blind to a meaningful chunk of your current attack surface.

TL;DR:

  • Continuous penetration testing is most beneficial for organizations releasing code frequently, expanding cloud environments, or handling sensitive customer data via APIs.
  • Automation handles repetitive discovery and vulnerability checks, but human testers must validate exploitability and business logic flaws for accurate results.
  • Regular asset discovery, proper scope definition, and a clear approval process are essential to prevent scope creep and alert fatigue in ongoing programs.
  • Implementing continuous testing requires integrating with existing CI/CD pipelines, setting remediation SLAs, and automating retests to provide actionable and timely findings.
  • Most effective programs pair automated scanning with human verification, with costs starting around $1,000 for initial assessments and $795 monthly for ongoing coverage.

Table of Contents

What Is Continuous Penetration Testing, and How Is It Different?

A point-in-time pentest is a snapshot: a tester spends one to two weeks probing your environment, then hands you a PDF that starts aging the moment your team merges the next pull request. Continuous penetration testing instead runs discovery and validation on a rolling basis, so new endpoints, subdomains, and cloud assets get tested close to when they appear, not months later.

The model splits work by strength. Automation handles repetitive discovery and known-vulnerability checks at scale. Human testers confirm exploitability, chain findings together, and dig into business-logic flaws that scanners routinely miss.

Coverage typically spans:

How Continuous Programs Are Organized: Automation, Humans, and the Offensive SOC

A working continuous testing program is a pipeline, not a tool. Attack-surface management (ASM) constantly maps your external footprint. Automated scanners run against that map on a schedule. Human testers step in wherever a finding needs exploit validation or logic that a scanner can’t reason through.

This division of labor matters because automated output alone doesn’t hold up to scrutiny. One Synack survey found 79% of enterprise security leaders would not act on an automated finding without human confirmation first, which is exactly why the “automation plus verification” model has become the operating standard rather than a nice-to-have.

The typical operational sequence looks like this:

  1. ASM detects a new asset, subdomain, or API endpoint entering your environment.
  2. Automated scanning runs baseline and known-vulnerability checks against it.
  3. A human tester validates any flagged issue, confirming real exploitability with request/response evidence.
  4. Confirmed findings route into ticketing with remediation guidance attached.
  5. A retest closes the loop once engineering ships a fix.

This is the core of what SANS describes as the “offensive SOC” model: continuous ASM signals trigger targeted, validated testing instead of waiting for a scheduled engagement window. New exposure gets tested days after it appears, not months.

When Does Continuous Testing Fit Your Risk Profile?

Continuous penetration testing earns its cost when your environment changes faster than your audit calendar. Ask whether these apply to you:

If most of those are true, continuous coverage on your highest-velocity assets makes sense, while deeper, scenario-based engagements run quarterly or annually for systems that change less often, like legacy back-office tools or vendor integrations. Continuous testing doesn’t replace compliance-driven assessments required by frameworks like PCI DSS or SOC 2. It fills the gap between them, so an auditor isn’t relying on a nine-month-old report to vouch for your current posture.

How to Implement Continuous Penetration Testing: A Step-by-Step Checklist

Standing up a continuous program is mostly a governance exercise before it’s a technical one. Work through these steps in order:

  1. Define dynamic scope. Connect ASM discovery rules so new subdomains, endpoints, and cloud assets auto-join the testing pipeline instead of waiting for someone to update a spreadsheet.
  2. Set authorization boundaries. Document what’s in scope, what’s off-limits, and get written sign-off from stakeholders before any test touches production.
  3. Establish blast-radius controls. Decide which tests can run against production safely and which stay confined to staging.
  4. Integrate into CI/CD. Add pre-production security gates and production-safe probes tied to your deployment pipeline, feeding results into the same ticketing system engineering already uses.
  5. Write triage rules and SLAs. Set remediation priority by exploitability and business impact, and automate retesting once a fix ships.
  6. Balance staffing. Reserve automated coverage for breadth and manual research hours for the handful of assets where business logic actually matters.

The OWASP Web Security Testing Guide offers a practical baseline of test cases for mapping what your automated scans and manual tests should each cover on web and API workloads.

Pro Tip: Don’t integrate CI/CD gates and full ASM discovery in the same sprint. Pilot the CI/CD gate on one high-velocity app first, prove the workflow, then expand scope. Trying both at once is how teams end up drowning in unvalidated findings within a month.

Metrics and Reporting That Prove the Program’s Value

Leadership doesn’t want a pile of findings. They want a trend line showing risk going down. Track these KPIs:

Evidence needs two layers. Engineering wants reproduction steps, request and response captures, and screenshots they can act on directly. Leadership wants a trend dashboard that shows exploitability rate and MTTR moving in the right direction over quarters, not individual tickets.

The NIST Cybersecurity Framework gives a risk-based structure for justifying testing cadence, and its controls mapping doubles as ready-made audit evidence when a compliance reviewer asks why your testing frequency looks the way it does.

Operational Challenges: Scope Creep, Noise, and Governance

The two failure modes that kill continuous programs are scope creep and alert fatigue. Left unmanaged, “test everything continuously” turns into testing infrastructure nobody asked for while critical assets go unchecked.

SANS notes that scope creep is one of the most common operational breakdowns in continuous programs, almost always traced back to discovery rules nobody maintained.

Pro Tip: Set a quarterly scope review, even in a fully automated ASM pipeline. Auto-discovery finds assets; it doesn’t always retire them when they’re decommissioned, and stale scope wastes testing budget on systems that no longer exist.

Who Actually Runs Continuous Testing Well

Earthshaker Security specializes in automated and human-verified security testing for web applications, identifying weaknesses like broken access control and code injection before an attacker finds them first. The methodology pairs automated scanning with manual verification, and every finding ships in a report with clear, actionable fixes rather than raw scanner output that needs translating.

A Practical 90/180/365 Roadmap for Getting Started

Most teams overbuild on day one. Don’t. In the first 90 days, run discovery across your environment and pilot continuous testing on one high-velocity application, nothing broader. By month six, integrate with CI/CD, set remediation SLAs, and automate retesting for confirmed fixes. At twelve months, you should have board-ready trend reporting and audit artifacts on tap.

If your triage process can’t handle weekly findings without a backlog forming, pause expansion and fix that first. Speed without a remediation pipeline just produces a longer list of ignored tickets.

— caleb

Get Continuous Coverage Without the Agency Overhead

Most continuous testing programs stall for one reason: teams either can’t staff the human-verification side, or they get buried under unconfirmed scanner alerts nobody has time to validate. Some providers solve that by pairing automation with hand-verified exploit confirmation on every finding, so engineers only see issues that are real and worth fixing.

The Starter engagement runs $1,000 one-off for teams that want a first assessment before committing further, while the Retainer plan at $795 per month suits organizations that need ongoing coverage without negotiating a new statement of work every quarter. Larger or nonstandard scopes run on a custom day rate. Every engagement, whether a web application penetration test or API and endpoint testing, includes a retest once you’ve shipped a fix, so you get confirmation of closure instead of taking your own word for it. If you’re weighing whether to build a continuous program in-house or hand it to a team that already runs one, start with a discovery call and scope a pilot on your highest-velocity application.

Sources

FAQ

What are the three main types of penetration testing?

The three main types are black box (no prior system knowledge), white box (full access to source code and architecture), and gray box (partial knowledge, often mimicking an insider or compromised-credential scenario). Continuous programs typically use gray box conditions since testers keep standing access to systems under ongoing coverage.

Is penetration testing illegal?

Penetration testing is legal when performed with explicit written authorization from the system owner; testing systems without permission is unauthorized access and can violate computer-crime laws in most jurisdictions. Every legitimate engagement, continuous or point-in-time, starts with a signed scope and authorization agreement.

What are the best tools for continuous penetration testing?

Effective programs combine attack-surface management platforms for discovery, automated scanners for baseline coverage, and human testers for exploit validation. No single tool replaces that mix. Earthshaker Security runs this exact model, layering automated scanning with hand-verified findings rather than relying on scanner output alone.

What are the seven phases of PTES?

The Penetration Testing Execution Standard defines seven phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. Continuous programs compress and repeat these phases in tight, ongoing cycles instead of running them once a year.

How much does continuous penetration testing cost?

Costs vary by scope and engagement model. Earthshaker Security’s Starter engagement is $1,000 one-off, its Retainer plan runs $795 per month for ongoing coverage, and larger custom scopes are billed at $450 per day; current pricing for Pro and other services is available on the pricing page.

Recommended

Next
Want this run against your app?
Book a scan