Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
What is continuous security testing?
Last verifiedContinuous security testing is automated SAST, DAST, SCA, and scanning in CI and production-adjacent environments. It covers the months between point-in-time pen tests. It complements a scoped manual test; it does not replace one. This page is not legal advice.
Continuous testing, last verified 10 September 2026 against NIST SP 800-218 (SSDF), NIST SP 800-137 (ISCM / continuous monitoring), and OWASP DevSecOps materials. Those texts are guidance and community practice, not a statute that forbids an annual pen test. Not legal advice.
Two clocks, one program
Audience: an engineering leader covering gaps between annual tests. This page is not legal advice. Kind of text: NIST SP 800-218 and SP 800-137 are US guidance. OWASP DevSecOps materials are community best practice. PTaaS (penetration testing as a service) is a commercial delivery model, not a standard. ShipReady Metrics recommendation: run the continuous layer every week; still commission an independent scoped test when a driver exists.
Point-in-time versus continuous
Last verified 10 September 2026. Continuous testing complements, not replaces, scoped manual pen tests. Not legal advice.
| Dimension | Point-in-time pen test | Continuous testing | Kind of text |
|---|---|---|---|
| Who | Independent testers under rules of engagement. | Pipelines, scanners, and first-party SAST/DAST. | Best practice / SSDF guidance. |
| When | Annually or after significant change (common bar; PCI 11.4 if PCI applies). | On every change and on a schedule. | See cadence page; not a universal law. |
| What it finds | Chaining, business logic, assumptions the pipeline never modeled. | Known patterns, dependency CVEs, crawlable runtime issues. | OWASP / NIST methodology. |
| PTaaS | A subscription that queues human tests more often. | Still a human test when a tester is on keyboard; the “as a service” label is delivery, not magic. | Commercial model — not a standard. |
| Does it replace the other? | No. A yearly PDF does not watch Tuesday’s deploy. | No. A green pipeline does not satisfy a contract that names an independent pen test. | SRM recommendation + industry practice. |
What to do now
Operational steps. Last verified 10 September 2026. Not legal advice.
- Turn on SAST, DAST, and SCA in CI. Open the SAST vs DAST vs SCA guide on this site.
- Triage with KEV, EPSS, and CVSS so continuous noise does not hide exploited issues.
- Keep the independent test on the calendar your driver requires. Continuous coverage is not a waiver.
- If you already have a session: signed-in app → Compliance → Evidence stores both pipeline exports and the annual report.
Checklist
Question list. Not legal advice.
- What runs on every pull request?
- What runs against a live preview?
- Who owns triage SLA for KEV-class findings?
- When is the next independent scoped test?
Where this shows up in ShipReady Metrics
First-party SAST and DAST, continuous vuln-management ingest (KEV, EPSS, CVSS), cross-source dedup, and blast radius are the continuous layer. They complement, and do not replace, a scoped manual pen test. The product does not determine that a framework applies to YOU and does not start a clock.
Primary sources (last verified 10 September 2026)
NIST SP 800-218 (SSDF). NIST SP 800-137 (information security continuous monitoring). OWASP DevSecOps / WSTG materials. Not legal advice.