Annual pentests are broken: continuous testing for SaaS

The contradiction

A modern SaaS ships to production multiple times a day. The annual pentest tests a snapshot from twelve months ago. Between two engagements, the application becomes a product the previous report no longer describes.

This is not a theoretical gap. We see it in every client engagement: the high-severity findings on a web app rarely come from the code that existed at the last pentest. They come from features shipped in the months after.

Why annual cadence persists

Three reasons, none related to security outcome.

1. Cost. A serious boutique pentest is €15,000 to €40,000. Companies budget once a year because that is what they can afford.
2. Procurement cycle. Scoping plus contract plus calendar slot plus engagement plus report regularly takes three months. Doing it twice means six months of overhead.
3. Auditor habit. Most ISO 27001 and SOC 2 auditors stamp annual cadence as sufficient because it has historically been the market norm.

None of these are security arguments. They are friction arguments.

A pentest scoped twelve months ago, on a system shipped four months ago, is documenting the past. Auditors increasingly notice.

What continuous looks like in practice

Three concrete patterns we see working.

Pattern 1: per-deploy pentest gate. Every production deployment triggers an automated pentest scoped to the changed surface (new endpoints, modified auth flows, dependency changes). Results land in the deploy ticket. CI green plus pentest green equals ship.

Pattern 2: weekly full-surface rescan. A scheduled pentest covers every web app, API, and external IP every Monday. Findings are diffed against the previous week. New findings open Jira tickets automatically.

Pattern 3: quarterly deep engagement. Every three months, a full intrusion test runs at maximum depth. Results feed the board risk review and the auditor binder.

Most clients combine two. Per-deploy plus weekly. Or weekly plus quarterly.

What changes for the SOC and the CISO

The work shifts from "schedule the engagement" to "manage the alert volume." Three operational consequences:

1. Triage protocol. Continuous testing produces continuous findings. You need a clear severity-to-action map: P0 pages someone, P1 opens a ticket, P2 lands in the weekly review. Not different from existing alerting protocols, just applied to pentest output.
2. Remediation velocity becomes the bottleneck. Once detection is continuous, the time-to-fix metric replaces the time-to-test metric as the operational KPI. CISOs who chase a green dashboard end up running the dev team, not the security program.
3. Auditor evidence flips from snapshot to history. A DORA or NIS2 audit no longer asks "show me last year's pentest." It asks "show me the trend." Continuous testing answers that natively.

Pricing that actually works for continuous

The annual €25,000 pentest cannot scale to weekly. The math does not work. The shift requires a subscription that prices the platform, not the engagement.

At Fleuret we list a continuous tier at €35,000 a year, unlimited scans, weekly automated rescans, Jira push per finding, DORA-mapped audit PDFs with offline-verifiable Ed25519 signatures. Same price as one boutique pentest, run every week.

If you ship to production more than once a year and your pentest cadence does not match, let's talk.

Related reading

• Continuous AI pentesting and NIS2: why regulators no longer accept annual snapshots.
• DORA pentest requirements 2026: the new EU finance baseline on cadence.
• Pentest cost in Europe 2026: what continuous testing actually costs.
• The compliance workflow moat: Jira plus signed audit PDF plus board export.