Question 1

What is pentest as a service?

Accepted Answer

Penetration testing you subscribe to rather than book. Instead of scoping an engagement, waiting for a slot and receiving a document weeks later, the target stays under test on a cadence you set, and every run ends with the same report an engagement ends with. interopt runs it with an AI pentester, so how often you test is not limited by anyone's calendar.

Question 2

Is this continuous pentesting?

Accepted Answer

Yes, that is the default shape of it. You set the schedule and the same depth runs again every time, so the answer keeps up with what you ship instead of describing a version you no longer run. A one-off engagement tells you what was true on the day it finished; this keeps answering after every release.

Question 3

Is this a scanner on a timer?

Accepted Answer

No. A scanner repeats a list of signatures. Each run here maps what is reachable, logs in as the roles you gave it, works through access control and business logic, and has to prove a finding with a request and a response before it reaches you. Repeating it is what makes it continuous; what it does on each pass is a pentest.

Question 4

How is this different from hiring a pentest firm?

Accepted Answer

An engagement answers the question once, on one date, and you ship code after it. A subscription keeps answering it on every release, with the evidence attached to every finding and the fix already written. Where a scheme insists on a named firm signing the report, that signature is what is being bought, not a difference in what gets tested.

Question 5

How often should we run it?

Accepted Answer

On every deploy if you can tell interopt when you ship, through your repository or a deploy hook in your pipeline; weekly if you cannot. Slower cadences still work and are the right answer for something that barely changes, but the value comes from the run landing near the change that caused the finding.

Question 6

How quickly can we start?

Accepted Answer

The same day. A URL is enough for a first run, and its findings are in when it finishes. Adding test accounts or a repository takes minutes and deepens every run after it. Targets live in one inventory, each with its own depth and schedule, so a new application is another entry rather than another purchase.

Question 7

Will it flood us with duplicates?

Accepted Answer

No. A finding that is still open on the next run is the same finding with a longer history, not a new one. What is new is flagged as new, and you choose the severity that is worth an alert in Slack, Teams or Discord.

Question 8

Do we still get a report an auditor will accept?

Accepted Answer

Yes, one per run. It is the same report an engagement ends with, generated from the run, and it is what teams hand over as pentest evidence for ISO 27001 or SOC 2. Those schemes ask for testing at a defined interval and evidence that it happened; the schedule is the record of the interval. Your auditor decides what they accept, and what you can show them is a dated report for every run instead of one for the year.

Question 9

Does it touch production?

Accepted Answer

Only what you point it at, inside the scope you set. Most teams start against staging and plenty move to production once they have watched how it behaves. A white box run can also build the environment from your repository, so nothing of yours is touched at all.

Question 10

What does it cost?

Accepted Answer

Plans start at €49 a month to test every code change. Team, at €249 a month, adds a full pentest every month and starts with a 7-day trial that includes one full run. Past the included credits you buy more. The plans are on the pricing page.

A pentest you subscribe to, not one you book.

From a URL to a pentest that runs on its own.

Name the target, then hand over as much as you want.

Continuous by default, at the interval you pick.

What every run leaves behind.

One finding, tracked across runs.

What a subscription replaces.

Nothing to scope, nothing to schedule

One subscription, every application

Findings in hours, not weeks

The report is an output, not a project

Remediation is part of the service

You pay for what it proves

Questions, answered.

Put a target under test today.