What is penetration testing as a service (PTaaS)?

Pentest as a service replaces the one-off, project-based penetration test with a continuous service on an agreed schedule. Pentesters work with their own role directly in your workspace. Findings with evidence images are visible immediately and marked as verified, and retests are requested with one click. At blacklens.io, manual and automated results share the same workflow, so your team runs only one process.

Web applications, APIs and infrastructure that you define as pentest targets. The scope is agreed before the first test and can be adjusted before every test, for example when new systems go live. The pentesters use the platform's attack surface data as their starting point.

How does PTaaS differ from the automated vulnerability scan?

The scan continuously checks against more than 200,000 known test cases and finds vulnerabilities in software, configuration and services. The pentest adds the human perspective: logic flaws, faulty authorisation, chained attacks and abuse of features that technically work correctly. Together they give a reliable picture; the results sit in one list.

How does a retest work?

After fixing, you request a retest on the affected finding. The pentester checks that specific vulnerability, documents the result and closes the finding once the fix is confirmed. The entire history, including evidence images and comments, is preserved for audits.

Does the report meet NIS2, DORA or ISO 27001 requirements?

The Penetration Test Report documents scope, methodology, findings with severity, evidence and retest results and is generated directly from the platform. It serves as evidence of regular security testing for auditors, supervisory authorities and insurers. Which intervals and depth your regulation requires is something we clarify with you during planning.

How is PTaaS licensed?

Penetration testing is a separate licence tier, priced by the number of pentest targets and the chosen test cadence, from weekly to yearly. The platform features for evidence images, retests and the pentest report are included. Add new systems as additional pentest targets as soon as they go live.

PTaaS

Penetration testing as a service

Certified pentesters test your applications and infrastructure on the schedule that fits each system, from weekly to yearly. Every finding appears as a verified finding next to your scan results.

Talk to an expert Start free trial

Penetration testmanually validated

Authentication can be bypassedportal.beispiel-gmbh.atVerified

Other users' records readable via APIapi.beispiel-gmbh.atRetest passed

No limit on login attemptsshop.beispiel-gmbh.atUnder review

Visuals show sample data.

test cadence per target, from weekly to yearly: Continuously
automated tests between pentests: 200,000+
for an AI analysis of a pentest finding: ≤ 30 s

What scanners do not find

Flaws in business logic, authorisation or chained attacks are only found by a person. Our pentesters start from the platform's view of your attack surface.

FindingPentest

Privilege escalation via tampered roleportal.beispiel-gmbh.atHigh

VerifiedPentester

Evidence 1

Evidence 2

Evidence 3

Proof of concept attachedRequest retest

Visuals show sample data.

Logic and authorisation flaws
Authentication, roles and workflows in web applications and APIs.
Manually validated
Every finding is confirmed by the pentester and marked as verified.
Evidence on the finding
Screenshots and proofs of concept sit on the finding, no follow-up questions.

One pentest cycle in four steps

1
Before the first test
Set scope and cadence
Web applications, APIs and infrastructure as targets, each with its own test cadence from weekly to yearly.
2
During the test
Findings visible immediately
Confirmed findings appear in your workspace right away and trigger your alerts.
3
After the fix
Retest in one click
The pentester checks the fix and closes the finding. The history is preserved.
4
After every test
Report and walkthrough
Penetration Test Report as PDF and joint prioritisation of the next steps.

Results in the platform, not in a PDF attachment

Pentesters work with their own role in your workspace. Your team handles their findings like any other finding.

Remediationone workflow for every source

12Open

5In progress

2Risk accepted

48Closed

CVE-2024-21762

Assigned to IT operations
Update installed
Re-scan confirmed: closed automatically

Pentest targets4 targets

api.beispiel-gmbh.atAPIWeekly

portal.beispiel-gmbh.atWeb applicationMonthly

203.0.113.0/28InfrastructureQuarterly

shop.beispiel-gmbh.atWeb applicationYearly

Next test for api.beispiel-gmbh.at in 3 days

Reportsscheduled by email

PDFExecutive reportWeekly, Monday 07:00

PDFVulnerability reportMonthly

PDFPentest reportAfter every test

Management, head of IT

Visuals show sample data.

Frequently asked questions

: Pentest as a service replaces the one-off, project-based penetration test with a continuous service on an agreed schedule. Pentesters work with their own role directly in your workspace. Findings with evidence images are visible immediately and marked as verified, and retests are requested with one click. At blacklens.io, manual and automated results share the same workflow, so your team runs only one process.
: Web applications, APIs and infrastructure that you define as pentest targets. The scope is agreed before the first test and can be adjusted before every test, for example when new systems go live. The pentesters use the platform's attack surface data as their starting point.
: The scan continuously checks against more than 200,000 known test cases and finds vulnerabilities in software, configuration and services. The pentest adds the human perspective: logic flaws, faulty authorisation, chained attacks and abuse of features that technically work correctly. Together they give a reliable picture; the results sit in one list.
: After fixing, you request a retest on the affected finding. The pentester checks that specific vulnerability, documents the result and closes the finding once the fix is confirmed. The entire history, including evidence images and comments, is preserved for audits.
: The Penetration Test Report documents scope, methodology, findings with severity, evidence and retest results and is generated directly from the platform. It serves as evidence of regular security testing for auditors, supervisory authorities and insurers. Which intervals and depth your regulation requires is something we clarify with you during planning.
: Penetration testing is a separate licence tier, priced by the number of pentest targets and the chosen test cadence, from weekly to yearly. The platform features for evidence images, retests and the pentest report are included. Add new systems as additional pentest targets as soon as they go live.

Plan your next pentest.

We set scope and interval with you. Automated monitoring runs from day one.

Talk to an expert Try free for 14 days

14 days free, all features
No credit card required
We walk you through your first findings

Penetration testing as a service

What scanners do not find

One pentest cycle in four steps

Results in the platform, not in a PDF attachment

Frequently asked questions

Related solutions

Plan your next pentest.