Pentest as a Service with SecTepe SnapScan
We attack your systems in a controlled way, all the time, and manage it for you. For this we useSecTepe SnapScan, our own pentesting platform. We host it ourselves in Germany. You start tests whenever you want. Real attack steps only run after your approval, in stages. Every step is logged without gaps. The service adds to the classic pentest. It does not replace it.
SnapScan Run #42
last 24h · hybrid scope
What is Pentest as a Service?
PTaaS closes the gap between two annual pentests. Instead of a single snapshot, the attacks run all the time and on their own, against your live systems. SecTepe steers the tests and explains the results.
Continuous, not a snapshot
Regular runs show right away when settings drift, new systems are exposed or old bugs come back after a release. You do not wait for next year's pentest.
Whole attack paths
SnapScan links gaps, wrong settings and weak passwords into real attack paths. You get more than a list of single flaws.
Production-safe & GDPR-compliant
Safe exploits that do not knock systems over. A program on your servers is only an option. If you use it, you approve every single command. Data stays in the EU, and every action is logged.
SecTepe SnapScan
We do not run PTaaS on a bought-in US platform. We built our own and run it ourselves. That decides where your findings sit and who can see them. It also decides how fast we can change something when your setup needs it.
Sovereign and self-hosted
The platform runs in German data centres. Or, if you prefer, fully on your own systems. No usage data goes to a third party. And you do not pay for anyone else's licence.
- Operated by us, or self-hosted by you
- As containers or a locked-down appliance, digitally signed
- Keeps several companies apart, with roles, rights and a full log
We develop it ourselves
Whatever our analysts find missing in the field, we build in. You are not talking to a reseller but to the team that writes and runs the platform.
- Findings flow into your information security management system (ISMS) as evidence
- When a new critical flaw is published, we retest all systems
- Open export of findings for your own automated workflows
What SnapScan delivers
Eight features that clearly set PTaaS apart from a plain vulnerability scan.
AI-driven pentest
An AI does not just tick off a checklist. It follows leads, links findings and digs deeper. It records each step so you can follow it.
Exploitability, not a raw list
Three test stages prove what can actually be exploited. You get proof instead of “potentially vulnerable”.
Attack chains & blast radius
Shows the few combinations that really cause harm. Each target gets a grade from A to F.
Internal pentest via test machine
A test machine in your network, tied to one engagement and a signed scope. It checks Active Directory, passwords and ways to gain more rights. Only with your explicit approval.
Cloud and Kubernetes posture
Your settings in AWS, Azure and GCP, checked against CIS guidance. Plus a read-only check of Kubernetes clusters.
Attack surface in view
Subdomains, services and certificates are tracked all the time. You see what changed since the last run.
Scheduled and on-demand runs
Run on a schedule or with one click. For example before a release, after a move, or when a new critical flaw is published.
Finding-level retest
One click checks a single finding again. The result is recorded: fixed, still there, or unclear.
Our managed PTaaS process
Five clear steps. That way PTaaS is an ongoing security service, not just a tool.
Onboarding & scoping
Together we define your most valuable assets, the systems, how often to test and the ground rules.
SnapScan setup
We set up your space, place the test machine and connect Active Directory, cloud accounts and your ticket system.
Continuous pentesting
Automatic runs on a schedule or when something happens. From outside, inside, in the cloud or mixed.
Triage by SecTepe
Our analysts review every finding, weed out false alarms and decide what comes first.
Remediation & retest
We advise on fixes and test again afterwards. Reports show the trend, also for audits.
Classic pentest vs. PTaaS
The two work well together, and neither replaces the other. The table shows what each does best.
| Criterion | Classic pentest | PTaaS with SnapScan |
|---|---|---|
| Methodology | manual, analyst-driven | autonomous, platform-driven |
| Frequency | point in time (annual / release) | continuous / on-demand |
| Business-logic flaws | ✓ strong | limited |
| Environment coverage | scope-limited | ✓ very broad |
| Time to react to changes | project cadence | minutes to hours |
| Regulatory fit | ISO 27001, NIS2, TISAX, DORA (formal evidence) | complementary evidence of continuous effectiveness |
| Typical value | deep audit, logic risks | spotting changes, clearing releases |
Our advice: one manual pentest a year for depth. Plus ongoing PTaaS so nothing goes stale.
Where PTaaS is particularly strong
In these four cases, ongoing automated testing helps the most.
Mid-market under NIS2
Regular evidence of effectiveness between audits — without building your own red team.
Critical-infrastructure operators
Ongoing watch over every point of attack, for regulated sectors like energy, healthcare and finance.
MSSP and SOC customers
Checks whether your monitoring really fires. Does your SOC react to real attacks?
Teams that ship often
No new release goes live until a PTaaS run has checked the changes and found nothing.
What you get out of every run
Every run gives you results you can act on right away. For top management, for tech teams and for audit.
Executive summary
A summary for top management. It shows attack paths, a risk score and progress over time.
Proof with the full attack path
For each finding, the steps to repeat it and tamper-proof evidence. Proven attack paths are marked as such.
Prioritised remediation guidance
Sorted by impact. We add whether a flaw is already being exploited (CISA KEV) and how likely that is (EPSS). Your team knows what to fix first.
Trend reporting over time
Continuous view: are attack surfaces shrinking, are risks staying open for long?
Compliance mapping
Indicative mapping to ISO 27001 Annex A and BSI IT-Grundschutz as a basis for evidence — not a certification statement.
SecTepe triage & remediation guidance
Our analysts explain the findings and weed out false alarms. They support the fix all the way to the retest.
PTaaS Trend — Q1/2026
12 runs · hybrid scope
Frequently asked questions about PTaaS
Answers to the most common questions about Pentest as a Service with SnapScan.
Does Pentest as a Service replace a classic penetration test?
Where does SnapScan run and how is data processed (GDPR)?
Is this safe for production?
How often should PTaaS run?
How is pricing structured?
Which environments does SnapScan cover?
Ready for continuous pentesting?
Start with a no-obligation SnapScan demo or a scoping call. We show you a live run against a test environment. And we sketch how PTaaS fits into your security operations.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.