12-month framework
Monthly planning
Target-specific testing model
Centralized platform results

Main benefits

Coordinate multiple security-testing activities throughout the year.

Plan, execute, and manage testing through one framework built for enterprise security teams.

One coordinated annual program

Replace disconnected pentest purchases with a 12-month framework that defines governance, annual capacity, reporting, and monthly planning before individual assessments launch.

The right testing model for each target

Use Hackrate internal pentesters for restricted assessments, selected Elite Ethical Hackers for approved crowdsourced testing, or combine both models.

Visibility from finding to resolution

Review findings, assign responsibility, monitor remediation status, and maintain a centralized view across the entire annual program.

A coordinated testing program

More than one pentest. More than one testing method.

Continuous Pentest is a comprehensive security-testing package, not a single assessment. It combines an annual roadmap, a contracted pool of internal pentester days, agreed access to invitation-only Pentest-as-a-Service activities, monthly planning, and centralized remediation management.

Each target is evaluated individually. The customer selects the most appropriate model based on sensitivity, exposure, architecture, recent changes, and business risk.

Flexible delivery

Internal, crowdsourced, or hybrid. The customer remains in control.

Before every activity, Hackrate and the customer approve the target, objective, access model, participants, timeline, and rules of engagement.

INTERNAL

Hackrate Internal Team

Restricted expert assessment

Only assigned internal pentesters test sensitive systems, restricted environments, authenticated applications, internal infrastructure, or targets that must not be shared externally.

  • Sensitive business applications
  • Restricted or internal environments
  • Context-rich specialist testing
ELITE HACKERS

Selected Elite Ethical Hackers

Controlled crowdsourced testing

Customer-approved targets are tested by a selected group through the Hackrate platform, adding diverse attacker perspectives and creative exploration.

  • Internet-facing web applications and APIs
  • Black-box attack simulation
  • Business logic and creative attack paths
HYBRID

Hybrid Testing

Internal depth and crowdsourced creativity

Internal specialists perform context-rich work while selected Elite Ethical Hackers examine approved areas from additional attacker perspectives.

  • High-value customer-facing applications
  • Complex application ecosystems
  • Targets needing depth and diversity
No target or technical information is shared with the Hackrate ethical hacker community unless the customer explicitly approves that target for Elite Ethical Hacker participation.

Annual program components

Contracted capacity with room to respond to changing priorities.

The framework defines governance, capacity, and commercial rules. Individual assessments are then prioritized and scoped through monthly planning.

Hackrate internal pentester days

A contracted annual pool of internal capacity assigned to approved assessments through the monthly plan.

Pentest-as-a-Service allocation

An agreed annual allocation for invitation-only testing with selected Elite Ethical Hackers.

Monthly security-testing meeting

A recurring meeting to review priorities and agree upcoming targets, objectives, timing, and delivery model.

Target-specific scoping

Every assessment receives its own scope, rules, participants, access method, communication process, and output.

Hackrate platform access

Validated findings are centralized for review, communication, ownership, and remediation management.

Program-level reporting

A consolidated view of assessments, risks, remediation status, recurring weaknesses, and future priorities.

A recurring operating model

Continuous Pentest in six recurring steps.

Review leads back to prioritization, keeping the program aligned with current risk throughout the year.

BASELINE

Build the annual roadmap

Review targets, known risks, planned releases, existing testing, and available capacity.

PRIORITIZE

Agree the next priorities

Identify the targets and objectives that should receive attention during the next cycle.

DESIGN

Select the testing approach

Approve internal, selected Elite Ethical Hacker, or hybrid testing for each target.

TEST

Execute the assessment

Launch the agreed activity with assigned internal specialists, selected hackers, or both.

REMEDIATE

Assign and track findings

Route validated issues to the appropriate owner and monitor resolution in the platform.

REVIEW

Measure and repeat

Review results, remediation, remaining risk, environmental changes, and capacity before the next cycle.

Monthly governance

Keep the testing roadmap aligned with current risk.

New systems launch, applications change, incidents expose new questions, and remediation work alters the risk profile. The monthly planning meeting directs contracted capacity where it can provide the most value.

Recommended monthly agenda

  • Review completed testing
  • Review new and unresolved findings
  • Check remediation progress and ownership
  • Review significant changes
  • Prioritize the next targets
  • Select the testing model
  • Confirm scope and participants
  • Review remaining capacity

One source of truth

Every finding, owner, and remediation status in one place.

Findings from internal assessments and approved Elite Ethical Hacker testing are managed through the Hackrate Ethical Hacking Platform from identification through remediation.

Illustrative demo data only.

Immediate visibility

Review validated findings without waiting for the end of the annual program.

Clear ownership

Assign each finding to the responsible engineering, IT, security, or remediation stakeholder.

Resolution tracking

Maintain visibility into open, accepted, remediated, and verified findings.

Centralized evidence

Keep descriptions, evidence, communication, remediation information, and status history together.

Cross-program visibility

Review findings across targets and testing models instead of disconnected assessment documents.

Management reporting

Understand recurring weaknesses, remediation progress, and future testing priorities.

Enterprise use cases

Built for teams managing more than one target and more than one testing need.

Multiple applications and environments

Coordinate testing across customer-facing applications, APIs, internal systems, and other approved targets.

Frequent product changes

Adjust priorities around releases, major changes, new integrations, and areas of increasing business risk.

Distributed remediation teams

Assign findings to responsible engineering or IT teams while maintaining centralized security oversight.

Recurring assurance requirements

Maintain evidence of planned testing, identified risks, remediation activity, and control review throughout the year.

Recurring evidence

Support control testing throughout the year, not only at audit time.

Continuous Pentest can support recurring risk assessment, control-effectiveness review, vulnerability management, remediation tracking, and internal assurance. It does not independently establish certification or regulatory compliance.

  • Annual security-testing roadmap
  • Approved scopes and rules of engagement
  • Completed assessment history
  • Validated vulnerability findings
  • Remediation ownership and status
  • Program-level management summaries

Choose the right model

Three ways to run penetration testing with Hackrate.

Select a focused internal assessment, an invitation-only crowdsourced engagement, or a coordinated annual program.

  Traditional Pentest Crowdsourced Pentest Continuous Pentest
Engagement model One scoped assessment One scoped, invitation-only assessment Recurring 12-month program
Testing team Hackrate internal team only Selected Elite Ethical Hackers Internal team, Elite Ethical Hackers, or a hybrid
Best suited for Sensitive, restricted, or traditional assessment requirements Creative testing with diverse attacker perspectives Enterprise teams with multiple targets and recurring needs
Customer control Customer approves scope and internal access Customer approves scope and selected-hacker participation Customer approves the model for every target
Results PDF only or platform plus PDF Hackrate platform and agreed reporting Centralized platform results across the annual program
Planning Project scoping before the assessment Project scoping before the assessment Annual roadmap and monthly prioritization
Explore Explore Traditional Pentest Explore Crowdsourced Pentest Explore Continuous Pentest

Frequently asked questions

Continuous Pentest FAQ

How is Continuous Pentest different from a traditional pentest?

A traditional pentest is one defined, time-bound assessment. Continuous Pentest is a 12-month framework with recurring planning, multiple activities, annual capacity, optional Elite Ethical Hacker testing, and centralized remediation management.

Does “continuous” mean testing is active every day?

No. It is a recurring, risk-based program. Testing activities are scheduled according to the annual framework and monthly priorities.

Who performs the testing?

Depending on the customer-approved model for each target, testing may be performed by Hackrate’s internal team, selected Elite Ethical Hackers, or both.

Is every target shared with the Hackrate community?

No. Information is shared with selected Elite Ethical Hackers only when the customer explicitly approves that target. Internal-only targets remain restricted.

What is included in the annual agreement?

It can include internal pentester days, an allocation for invitation-only Pentest-as-a-Service, monthly planning, platform access, coordination, and program reporting. Exact capacity and deliverables are defined commercially.

Can testing priorities change during the year?

Yes. Monthly planning allows remaining capacity to be redirected toward current risks and business priorities within the agreed framework.

Where are findings managed?

Validated findings are managed in the Hackrate Ethical Hacking Platform, where customers can review, assign, and track them.

Does Continuous Pentest guarantee compliance?

No. It can support risk-management, control-testing, vulnerability-management, and audit-evidence activities, but compliance depends on the complete control environment and applicable requirements.

Build the annual framework

Turn separate pentests into a coordinated annual security-testing program.

Build a 12-month framework around your target portfolio, risk priorities, internal testing requirements, and approved use of selected Elite Ethical Hackers.

Design Your Annual Program
Hackrate

Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.

US Patent Applied for HackGATE #63/645,845

Checking service status...
Company
Products
From the Blog
Hackrate is ISO 27001 certified

Hackrate Ethical Hacking Platform |
2026 ©

CVE Numbering Authority