Penetration Testing as a Service (PTaaS) Sell the Relationship, Not the PDF.
PTaaS is not a different kind of testing. It is the same testing sold as something continuous, which needs machinery a report-writing tool does not have: a portal that is still there in month seven, findings that reach the client the day you confirm them, retests they can ask for themselves, and a contract that renews without being resold. Pental is that machinery, wearing your name.
What Is PTaaS?
Penetration testing as a service (PTaaS) is a delivery model in which a testing firm provides penetration testing as an ongoing service rather than as a series of one-off projects. The tests are still planned engagements carried out by skilled people; what continues between them is the relationship, the results and the follow-up, usually under a recurring agreement.
What Changes When Testing Becomes a Service.
A project ends when the report is emailed. A service does not, and almost everything that makes the difference happens in the months where a project-shaped tool has nothing to say.
None of this makes the testing continuous. It makes the relationship continuous, which is what a client is actually buying when they ask for PTaaS: somebody who already knows their estate, whose findings they can see today, and who can retest a fix next week without a procurement cycle.
A Portal That Is Still There in Month Seven.
Client accounts in Pental are standing accounts on your own domain, not a share link that expires. Between engagements the portal is where their whole history with you sits; during one, it is where they scope, watch and receive.
- Their record, not a deliveryEvery engagement you have run for that client stays available to them: reports, findings and their current state, retest outcomes and attestation letters, a year later, without emailing you for a copy.
- Scoping in the portalTargets, credentials, environments and constraints are answered in a form attached to the engagement, so the next round starts from what the last one established rather than from a blank email.
- Credentials handled properlyAccess credentials the client submits arrive encrypted and one-time view against the engagement, which is the difference between a service and a shared mailbox.
- Their view, enforced below the interfaceA client sees its own organisation, its own assessments and only the findings you have released. That boundary is a database policy, not a hidden button.
- Questions in contextA query about a finding is raised against that finding, so the context is attached rather than arriving as a thread someone has to reconstruct.
Findings Reach the Client the Day You Confirm Them.
Release is a separate act from saving. You write a finding, it stays internal while it is being checked, and it becomes visible to the client the moment you decide it should, which is what lets a client start fixing in week one instead of week four.
- 01The finding is written, from evidence, and sits internal by default while anyone who needs to review it does.
- 02QA runs against it as a workflow rather than a favour: review states, comments anchored to the passage they concern, and approval before release.
- 03You release it. For a critical or high finding the platform asks first whether the client should be emailed about it now, because some of those are a phone call rather than a notification.
- 04It appears in their portal with its severity, evidence, affected assets and remediation, under your brand, whether or not the report exists yet.
- 05The report, when it comes, is generated from the same findings, so nothing has to be reconciled between what they were told and what they were sent.
Releasing a whole phase at once is one action rather than forty, and it asks once rather than prompting per finding. If part of it cannot be released, you are told that it was partial rather than left believing everything went out.
Run one engagement through it and release a finding to a test client. That is the whole argument, and the setup guide records every step.
Retests the Client Asks for Themselves.
The single most service-like thing a testing firm can offer is a fix being verified without a new sales conversation. In Pental the request starts where the client is already looking.
- Requested from the findingA client reading a released finding can ask for the retest there. It arrives on your side attached to the original, with its history rather than as a fresh ticket.
- A delta, not a rewriteA retest carries the original findings forward and tracks each as fixed, still open, or newly introduced, so the second document is about what changed.
- Its own phaseRetesting is a phase on the engagement with its own dates and testers, which means it is schedulable, assignable and billable like any other work.
- Per-phase controlRetesting can be switched on for the phases where it makes sense and left off elsewhere, so the offer matches what you actually sell.
- Closed loops are visibleWhere a client runs their own tracker, a closed ticket comes back as a signal to retest rather than as a claim that the issue is fixed.
What the Client Still Has a Year Later.
The renewal conversation is easy when the client has spent eleven months signing in to something with your name on it. This is what is waiting for them there.
- Every report you releasedIn one place, on your domain, when their auditor asks for last year's and their procurement team asks for the one before it.
- Attestation lettersThe letter confirming testing took place, generated as its own document type rather than written from scratch each time somebody asks.
- Findings and their current stateOpen, fixed, retested, and what was verified rather than assumed, which is the answer to most questions a customer of theirs will ask them.
- Coverage they can point atChecklists and runbooks can be marked client visible, so a client who wants to know what was actually tested can read it instead of taking your word for it.
- Feedback that compoundsStructured feedback at the end of an engagement, with a nudge towards a public review when it is glowing.
Your Name on It, Your Database Under It.
A service sold under someone else's branding is a reseller arrangement, and a service whose data sits in a vendor's database is a dependency you cannot answer questions about. Neither is true here.
- Your domain, your loginClients sign in at your address, on your sign-in page, in your colours. There is no Pental branding anywhere a client can look.
- Your documentsReports rendered from the Word template you already send, deterministically, so a client comparing this quarter with last sees only the findings change.
- Your databaseEvery client record, finding and file lives in a Postgres database you own, in your own cloud, on a server of yours or on Supabase Cloud, which is also the honest answer when a client asks where their vulnerabilities are stored.
- Your AIDrafting runs on your own provider key or a model on your own hardware, so nothing about your client's estate becomes someone else's traffic.
Questions About PTaaS.
The testing is the same skilled, manual work. What changes is everything around it. Instead of one report emailed at the end, the client signs in to a portal where they see each finding once you release it, download their reports, track remediation and request retests, all in the one place.
Each finding carries its own retest status. A client can request a retest from the portal, your team retests the fix and records the outcome against the finding, and the report includes a retest summary, so the client can see what changed without working through the whole report again.
Yes. Once an engagement has been delivered, an attestation letter is produced from a template with a named signatory. It confirms that the testing took place without handing over the findings themselves, which is usually what a client’s own customers or auditors ask to see.
No. Your plan limits the number of internal users, the people in your own firm, and the number of clients you hold. The people at each client who sign in to the portal to read findings and request retests do not count towards your user limit.
No. There are six self-serve plans, from a solo tester upwards, plus Enterprise, and every feature is on every plan, the client portal included. Plans differ only by the number of internal users and clients, so a two-person firm can offer the same service as a much larger one.
Turn Your Next Renewal into a Subscription.
Seven days free, no card, on whichever plan fits, and the whole platform inside its limits. Set up a client, release a finding to them, and see what the relationship looks like from their side.