Continuous penetration testing is a penetration testing service that runs across the whole year instead of once. It starts with a full baseline test, then tests your systems again whenever they change and whenever a relevant new attack technique appears.
Most small and mid-sized businesses test once a year because their auditor, insurer or customer asks for it. This guide explains how continuous testing differs from that, what compliance frameworks actually require, what it costs and how to choose a provider. WhatsExposed calls its version year-round penetration testing.
- Continuous vs annual penetration testing
- Continuous testing vs vulnerability scanning
- Is automated or AI penetration testing enough?
- What PCI DSS, SOC 2 and HIPAA require
- What counts as a significant change?
- What does the first look involve?
- How to choose a provider
How is continuous penetration testing different from an annual pen test?
An annual test checks your systems during one or two weeks of the year. Anything added afterwards, such as a new server, web app, cloud service or admin account, isn’t tested until the following year. Continuous testing covers those changes as they happen and usually includes unlimited retests of fixes.
| Annual penetration test | Continuous penetration testing | |
|---|---|---|
| Frequency | Once a year | A baseline, then throughout the year |
| Changes between tests | Untested until next year | Tested when they happen |
| Retests | Often charged separately | Usually included |
| How it’s sold | Per test, scoped each year | A subscription |
Is continuous penetration testing the same as vulnerability scanning?
No. A vulnerability scanner is software that checks your systems against a list of known weaknesses and reports what it finds. A penetration test has a person try to exploit those weaknesses, combine them into attack paths and show what an attacker could actually reach. Continuous penetration testing often uses scanning to spot changes, then sends a tester to test them.
Is automated or AI penetration testing enough?
For compliance, usually not on its own. The PCI Security Standards Council describes penetration testing as a highly manual process and says automated tools don’t replace skilled manual testing (quoted by Astra Security).
Automated tools are good at finding known issues. They’re weaker at chaining findings together and at testing business logic, such as whether one customer can see another customer’s data. What auditors accept is a qualified tester performing the test and signing the report, whether or not tools speed up parts of it. At WhatsExposed a certified tester leads every test, and AI-assisted tooling is optional.
What do PCI DSS, SOC 2 and HIPAA require?
- PCI DSS v4.0.1, Requirement 11.4: internal and external penetration testing at least once every 12 months and after any significant change, by a qualified tester who is organizationally independent (Praetorian). See our PCI DSS penetration testing page.
- SOC 2: the framework doesn’t name penetration testing, but most Type II auditors expect evidence of it (Astra Security).
- HIPAA: the current Security Rule has no explicit pen test requirement. A proposed update would require one every 12 months, and the final rule isn’t expected before July 2027 (Paubox).
What counts as a significant change?
Your provider should agree a written list with you before testing starts. Common examples:
- A new server or service reachable from the internet
- A new web application or a major release of an existing one
- A new cloud account, subscription or service
- Changes to firewalls or network segmentation
- A new privileged account or a change to admin access
- A merger, acquisition or new office joining the network
How much does continuous penetration testing cost?
A traditional US penetration test typically costs $5,000 to $35,000 per test type, depending on scope (Bright Defense, 2026). Continuous testing is usually sold as a subscription, priced per target, per credit or hour, or as a platform fee plus a charge per test.
WhatsExposed works on a single year-round retainer with no charge per IP address or asset. The first look at your estate is passive and costs nothing: see what’s exposed.
How do you choose a continuous penetration testing provider?
Ask these questions before you sign:
- Who checks each finding, and what certifications do they hold?
- Is the company accredited, for example by CREST?
- Who sets the severity of a finding, and is it someone other than the tester?
- What counts as a change, and when is it tested?
- Are retests included?
- Will my auditor or insurer accept the report?
- If I’m an MSP, can I sell it under my own brand?
- Does the cost rise as I add assets?
Year-round penetration testing from WhatsExposed.
A full baseline test, testing after every change, unlimited retests and every finding signed off by a certified tester, all year round.