Hey guys, random question.
For people working wit...
# randome
ethicalhumanoid
09/27/2026, 1:26 PMHey guys, random question.
For people working with SaaS companies, are you seeing much demand for continuous external pentesting these days?
Not just automated scanning, but someone continuously testing the external attack surface and only reporting findings they can actually prove/exploit.
Been exploring this space recently and curious if companies actually want this, or if most are still happy with annual pentests.
e
Erik Osterman (Cloud Posse)
09/27/2026, 1:52 PMI think most of the demand is compliance-driven by SaaS companies with SOC2 requirements. SOC 2 doesn’t explicitly require a pentest, but pentests are commonly used as evidence that security controls are actually effective, so the annual cadence maps pretty naturally to the audit cycle.
Erik Osterman (Cloud Posse)
09/27/2026, 1:52 PMContinuous pentesting is a harder sell IMO. Type II demonstrates that controls operated effectively over a period of time, but that doesn’t necessarily mean continuously adversarially validating the controls themselves.
Erik Osterman (Cloud Posse)
09/27/2026, 1:52 PMSo there’s definitely a security argument for continuous testing, especially for companies shipping constantly, but I’m not sure the compliance market has created the same forcing function for it yet. Annual pentests still check the box for a lot of SaaS companies.