Offensive / TestingSaaS / logistics technologyOngoing subscription, quarterly cycles
Moving a weekly-shipping scale-up from annual pentests to continuous coverage
Series B logistics platform, ~150 staff, weekly production releases
A logistics platform shipping to production weekly was buying one pentest a year — meaning fifty-one weeks of untested change. Moving to PTaaS put expert testing on the same cadence as engineering: new features tested in the cycle they ship, findings delivered through the portal as they're confirmed, and retests included instead of quoted separately.
Representative engagement — the client is confidential, and the figures and the quoted comment illustrate typical outcomes for the work described.
- Finding-to-ticket time
- weeks → same day
- findings stream to the portal as confirmed
- Remediated findings retested
- 100%
- included in the subscription, not re-quoted
- Release coverage
- annual snapshot → quarterly cycles
- with delta testing between
- Repeat finding classes quarter over quarter
- declining
- tracked in the trend review
The challenge
- Weekly releases meant the annual pentest report was describing a product that no longer existed within a month.
- Point-in-time findings arrived in a PDF weeks after testing, long after the responsible engineers had moved on.
- Retests were separately scoped and priced, so 'fixed' often went unverified.
What we did
- Established a quarterly testing cadence with delta testing focused on what changed since the last cycle.
- Streamed findings into the client portal with evidence and reproduction steps as each was confirmed, not batched at cycle end.
- Tracked the attack surface between cycles so new endpoints and services entered scope automatically.
- Included retesting of every remediated finding in the subscription, closing the verification gap.
- Delivered quarterly trend reviews showing where risk was accumulating across releases.
The outcome
- Median time from finding confirmed to engineering ticket dropped from weeks to the same day.
- Every remediated finding is now retested as standard — verification is no longer a budget line that gets cut.
- The quarterly trend review became the input for security investment decisions rather than a shelf document.
“The annual pentest was a photograph of a moving train. Now testing keeps pace with shipping, and my engineers get findings while the code is still fresh in their heads.”