Pentest-as-a-Service for a SaaS Company Shipping Weekly: Meeting SOC 2 Without a $50K Annual Engagement
An annual pentest answers a question about the system as it existed on one day of the year - for a team shipping every week, that answer expires almost immediately.
What we were solving
Growth-stage SaaS company shipping weekly, SOC 2 Type II requirement from an enterprise prospect, security team of two with no budget for a traditional $40-50K annual penetration test.
- SOC 2 auditors expect current, defensible penetration-test evidence - but a single annual test was already outdated by the time the next feature shipped.
- Traditional pentest pricing assumed a large, slow-changing scope; a weekly-release SaaS company's actual attack surface changed every sprint.
- The security team of two had no capacity to manage a traditional engagement's scoping, retest, and reporting cycle on top of their existing workload.
What we built
- Set up a rolling assessment cadence triggered by meaningful changes - new endpoints, auth flow changes, new integrations - instead of a fixed calendar date.
- Combined automated discovery scanning for continuous baseline coverage with focused manual testing on the highest-risk changes each cycle, not a full-scope manual test every time.
- Delivered findings as they were confirmed, not bundled into a single end-of-engagement report, so fixes shipped in the same sprint the finding was found.
Architecture notes for your engineers
- Findings fed directly into the client's existing ticketing system with severity-based SLAs, rather than a separate pentest-report PDF nobody tracked to closure.
- Retest-on-fix was built into the cadence so closed findings were verified, not just marked done.
Key results
- Continuous coverage matched to a weekly release cadence instead of one annual snapshot
- SOC 2 pentest evidence requirement satisfied at a fraction of traditional engagement cost
- Critical findings fixed within days of discovery instead of surfacing months later in a report
- Security team of two managed the whole program without adding headcount
What it was built on
Representative tools and patterns — exact vendors vary per client environment.
Continuous testing
Reporting & compliance
Coverage
What we'd tell the next team
- An annual pentest is a snapshot of a system that no longer exists by the time you read the report if you ship weekly - cadence has to match release velocity, not the calendar.
- Change-triggered testing catches more real risk than a fixed-scope annual test, because it's looking at what actually changed instead of re-testing what didn't.
- Findings delivered continuously into existing tickets get fixed; findings bundled into an end-of-engagement PDF get filed and forgotten.
Questions this engagement anticipated
Does continuous pentesting satisfy SOC 2 penetration-test requirements?
Auditors want current, defensible evidence that the environment has been tested - a rolling cadence with retest-on-fix and SOC 2-mapped reporting satisfies that requirement and produces more current evidence than a single annual snapshot.
How is this cheaper than a traditional annual pentest?
Automated discovery covers the baseline continuously and cheaply, while paid manual testing effort concentrates only on what actually changed each cycle - instead of re-testing a large, mostly-unchanged scope in full every single time.
This is one of several case studies on offensive security & continuous assurance.
See the rest of the cluster →Compare your situation to this case.
Bring your constraints - environment, timeline, and budget. We scope before we quote.