Most developers use pentesting to identify and resolve vulnerabilities both during development and after launch. Traditionally, you receive those vulnerabilities via a PDF report – which means breaking the report down and building tasks and actionable items yourself. While that’s alright and even normal for waterfall methodologies, Agile developers need different solutions. If you want to handle vulnerability management in an Agile way, you must give teams full ownership of work, prioritization, and pentesting.
Pentest-as-a-Service changes how Agile developers utilize pentests. While “Pentest-as-a-service” can vary slightly between applications, Cyver uses it to mean:
- Vulnerabilities are delivered as tickets, via a cloud platform
- Teams are onboarded, so stakeholders and developers see real-time results
- Vulnerability management tools, like CVSS scores, risk metrics, and heat maps
- Task visibility with assigned team members
- You pay using a “Credit” system, allowing teams to budget for pentests in advance. Then, devs can start pentests when they make sense.
- Scheduled pentests enable ongoing security
Essentially, the goal of Pentest-as-a-Service is to move pentesting and vulnerability management into the hands of the people doing the work – the devs.
Pentesting Applications with Pentest-as-a-Service
Pentesting applications with pentest-as-a-service means uploading assets and testing everything inside a cloud portal – with central management.
Set a Budget
Set yearly or quarterly budgeting and pay for pentests upfront. While this step is optional, it does mean pentesting can move forward seamlessly from that point – because the budgets have already been approved.
Onboard Teams
Onboard teams who will be responsible for fixes and integrate them into the platform. Teams get real-time notifications, see data, and can communicate in real-time with pentesters. That’s especially important when different teams manage different app modules, because every team can get immediate access to relevant findings.
Upload Assets and Manage Pentests and Vulnerabilities by Assets
Upload assets such as servers, IP addresses, websites, etc., and manage testing by asset. Link teams to assets so they receive notifications when vulnerability findings are uploaded for their assets. Everything is in one platform and clearly outlines. This makes project management easier – even with large applications with dozens of modules.
Findings-as-Tickets
All findings are uploaded as tickets which you can export to tooling like Jira and immediately assign to the relevant team. That makes it easier than ever to integrate remediation directly into Agile cycles.
Findings are uploaded as tickets. These are then linked to projects, to assets, and to teams. You can click through to view the vulnerability status, likelihood of occurrence, and risk level at-a-glance. Additionally, devs can see remediation recommendations, check proof of concept files, and contact the pentester right from the ticket.
Remediate and Request a Retest
Devs can remediate issues and then immediately request a retest. We review the vulnerability to see if it’s actually resolved. If so, you can mark the finding as closed. That allows for full work traceability, so you always see when a finding is fully resolved or not.
How Pentest-as-a-Service Impacts Application Pentesting
While pentest-as-a-service doesn’t change how app pentests are performed, it changes how they’re delivered. It also changes how developers can see and react to vulnerability findings.
Prioritization – We use heat maps, time-to-fix maps, and risk scores to help you prioritize fixes. That means you can see at-a-glance which vulnerability findings present the most risk and where they occur. While you can use your own prioritization, the platform automatically ranks your findings so you can see which to fix first. Plus, fixes can be prioritized on whatever metrics you want. By team, application, data sensitivity, risk, it’s up to you.
Project Management – We use templates for easy project management and scheduling. You request the pentest, schedule it, and then wait for us to pentest. It’s also easy to set up different templates. For example, you can test after new implementations using a light standard like OWASP Top 10. This is fast, cost-saving, and is likely to catch most issues. Then, you can follow up with more intensive pentesting once or twice a year to ensure your full environment is protected.
Findings-as-tickets also help to ensure projects are managed correctly. A PDF report means one or two people are responsible for delegating work out across the entire organization. Tickets, linked to teams, ensure work is visible and traceable. And, if something does slip through unnoticed, our built-in time-to-fix metrics ensure you get notifications.
Standardized Testing & Remediation – Our pentest-as-a-service platform means every pentest is conducted using the same methodology. Every finding is uploaded using the same standards. You get replicable, testable, and standardized testing – which can be repeated at scale across your full organization.
This makes it easier for devs to work with tickets, to immediately see what’s wrong, and to remediate issues.
That’s also true with setting up and requesting pentests. We use unique pentest templates, linked to your assets. When you request a new pentest, you use the same template (unless you need a different check) so everything runs automatically.
Vulnerability Management – Cyver delivers long-term vulnerability management and libraries. You can view and track vulnerabilities even after closing them. Additionally, you can see findings linked to assets, by category, and by risk level. This makes it easier to see where risks are occurring, what types of risks they are, and how they are occurring. Over time, this offers a better understanding of your organizational risks and allows you to introduce changes to resolve vulnerabilities at the source.
Pentest-as-a-Service platforms are designed to organize findings, manage vulnerabilities, and ensure remediation. We present findings in an organized, structured fashion, that can be mapped by compliance, by priority, and by asset. Once you add your teams, managing and remediating your application vulnerabilities becomes that much easier.
If you want to learn more, visit our how it works page. Or, schedule a demo now to see the platform in action.