PTaaS vs a Traditional Pentest: Five Things the Invoice Hides

Two pentest invoices can look almost identical and buy completely different things. A traditional engagement sells an event; penetration testing as a service sells a cadence. Over twelve months, the difference is not the line item. It is how many times the system was actually looked at.

Here are the five components that differ, written so you can apply them to any vendor including mine. Disclosure: I work on HackBox, an online automated penetration testing platform (SaaS) built by Singapore-based HACKBOX PTE. LTD.

1. Frequency, which is arithmetic

A traditional test runs two to four weeks, once or twice a year. If the application ships weekly, roughly forty releases happen between tests. A test in March describes March.

Ask: how many times will this target be tested in the next twelve months at no additional cost? If the answer is "once, then we scope again", the invoice is buying a photograph.

2. Scope, which is a setting or a negotiation

Per-application pricing makes scope a contract discussion, so anything unmentioned stays untested — usually staging, usually the internal admin panel. Per-target subscription models make scope a setting, which is how the environment everyone assumed was out of scope finally gets covered.

3. Evidence, which is not a PDF

A PDF is a narrative. Evidence is the request that proves the flaw, the response that came back, and the data extracted. Ask for those three artifacts for one finding before signing:

GET /api/v1/reports/2291 HTTP/1.1
Host: app.example.com
Authorization: Bearer <tenant-a-token>

200 OK
{"report_id":2291,"tenant":"tenant-b","url":"/exports/2291.pdf"}

That is a verified finding. "IDOR — high" with no request is an inference.

4. Retest economics

After a fix, someone must confirm the fix works. In the traditional model that is a change order or the next cycle; in a platform model it is a scheduled run against the same target, with the previous evidence still attached so a reviewer can see before and after.

5. Who reads the output

A traditional report is written for a buyer and a compliance folder. Platform output is read by whoever is on call at 2am, so the unit of delivery changes from "report" to "finding with a state": open, verified, exploited, fixed, retested.

Where traditional still wins

A platform vendor who claims full coverage is selling. Three cases belong in a manual engagement: novel business logic where understanding intent matters more than recognising a pattern; social engineering and physical scope; and regulatory attestation that needs a named tester to sign. Automation supplies evidence into that process; it cannot sign.

Five questions before renewal

1. How many runs per target in the next twelve months?
2. Show the full evidence package for one finding.
3. Do I keep my finding history after the engagement ends?
4. Can I add an environment tomorrow without a new contract?
5. After a fix, how is it re-verified?

Question three is the one that matters most. Engagements end; a system of record does not. A finding that lives only in a PDF is a finding the next engineer rediscovers from scratch, at full price.

FAQ

Is PTaaS cheaper? Not automatically. Compare twelve months and include retests, not one invoice.

How often? Match cadence to change rate — per release or monthly for fast-moving systems, quarterly for stable ones.

Will an auditor accept it? If reports carry methodology, dates and tester accountability, and a human signs.

Can it reach internal networks? Yes, via distributed nodes or an agreed tunnel. Ask how tenant isolation is enforced on the testing nodes; that question separates a platform from a script in the cloud.

All testing described here requires written authorization from the system owner, a defined scope and time window, and an agreed stop condition. Unauthorized testing is illegal in most jurisdictions, including under the Computer Misuse Act in Singapore and the CFAA in the United States.

About

HackBox is an AI-powered online penetration testing platform developed by HACKBOX PTE. LTD., a Singapore-based cybersecurity company. Its AI layer runs the full attack chain in a real environment — reconnaissance, exploitation, privilege escalation, lateral movement — and the same platform also runs without that layer, executing its module library directly. Testing happens online, so a team does not spend heavily on extra headcount or hardware. Pricing is flexible: subscription by target, or pay-per-result.

Media contact: [email protected]