Continuous pentesting (Professional)

A pentest proves one moment. Your product changes every deploy. Professional runs the same full pentest every month for each app, so the evidence stays as current as the product.

Price: see squr.ai/pricing. Professional is billed per app, monthly, and can be cancelled any time. A one-time pentest is the cheaper choice if you need a single report for an annual audit.

What each monthly run does

• A full pentest. The same pentest as a one-time engagement, black-box, or whitebox at no extra cost when you add source code.
• Re-tests your open findings. Each is marked Fixed, Regressed or New, so you see whether a fix held.
• Refreshes your reports with current evidence.
• Refreshes your certificate after a clean run.
• Alerts you to new or regressed findings.

Start a schedule

Start each run yourself when you are ready, or set a monthly schedule on the app. Open the app under Assets, then use the schedule control in its subscription card. Source code and setup saved on the app are used on every run.

Editing scope pauses the schedule

If you change an app's scope, scheduled pentests wait until you confirm the scope as it now stands.

See your program

Program in the sidebar lists each app with its cadence and status. It shows what is on track, due, overdue or never tested, and lets you launch a due pentest. To work out cadences for a whole portfolio, use the Pentest Program Planner.

Attack Surface alongside

Your scopes are re-checked weekly by Attack Surface, free. It watches for new exposure between pentests. It does not replace testing: a scan shows what is visible, the monthly pentest proves what is exploitable.