Penetration Testing as a Service: PTaaS vs Point-in-Time Tests, Scanning and Bug Bounties

By The Uptime Report Team · Last reviewed: October 2026

Penetration testing as a service (PTaaS) is a delivery model: human-led pentests ordered, tracked and retested on a vendor platform. It changes cadence and pricing, not what PCI DSS 11.4 counts as a pentest.

What is penetration testing as a service?

Penetration testing as a service (PTaaS) sells human-led penetration tests through a vendor platform: you scope a target online, testers start within days, findings appear in a dashboard as they are validated, and retests are ordered on the same platform. Cobalt lists start times of 3, 2 or 1 business days by tier on its pricing page (October 2026).

The test itself has to meet the same bar as any pentest. The guidance to Requirement 11.4.1 of PCI DSS v4.0.1 (PCI Security Standards Council, June 2024, p. 275) says “scanning for vulnerabilities alone is not a penetration test” and calls penetration testing “a highly manual process”. NIST control CA-8 in NIST SP 800-53 Rev. 5 draws the same line: penetration testing “goes beyond automated vulnerability scanning”.

What PTaaS changes is the commercial wrapper: annual per-target plans (Astra), per-test list prices (Synack, Intruder, Stingrai) or prepaid credits (Cobalt, where 1 credit equals 8 hours of testing) replace a one-off statement of work. The scan-versus-exploit line does not move, and our guide to vulnerability assessment and penetration testing shows where each activity sits in a testing program.

How does PTaaS compare with a traditional pentest, automated scanning and a bug bounty?

The four delivery models differ on who tests, when findings arrive and how you pay. A traditional engagement is a scoped project with a report at the end. PTaaS delivers human testing through a platform with live findings and platform retests. Automated scanning is software on a schedule. A bug bounty pays outside researchers per valid finding. Only the first two are built to produce the methodology-driven report PCI DSS 11.4.1 describes.

Delivery speed matters most when you ship often. PCI DSS v4.0.1 Requirements 11.4.2 and 11.4.3 call for a pentest “at least once every 12 months” and “after any significant infrastructure or application upgrade or change”, and 11.4.4 requires that “penetration testing is repeated to verify the corrections”. A team with two significant releases a year therefore faces at least three pentests a year, each followed by a retest of whatever it fixed, not one annual test.

Bug bounties sit outside that cycle. CISA Binding Operational Directive 20-01 notes that paying for findings “may also result in a higher number of reports or an increase in low-quality submissions”, and the directive “does not require agencies to establish bug bounty programs” (CISA, BOD 20-01, September 2020).

Which compliance rules set how often you must run a penetration test?

PCI DSS v4.0.1 and FedRAMP set hard intervals: a pentest at least every 12 months, and PCI DSS adds a test after any significant change. The current HIPAA Security Rule and the SOC 2 Trust Services Criteria name no pentest interval. None of these documents asks whether the test was bought as PTaaS or as a project; they ask about methodology, coverage and tester independence.

For FedRAMP, the Rev. 5 baselines set CA-8 at “at least annually” and the 2022 Penetration Test Guidance lists 6 mandatory attack vectors; FedRAMP has kept both as legacy reference since June 24, 2026. Its Consolidated Rules for 2026, mandatory from January 1, 2027, list only Program and Agency certification paths, with no JAB path, and assign assessments to FedRAMP or a FedRAMP Recognized independent assessor (certification paths; definitions), so ask any PTaaS vendor for proof of that recognition before using its report for federal work.

Does PCI DSS accept PTaaS?

PCI DSS v4.0.1, summarized requirement by requirement in our PCI compliance guide, accepts any delivery model whose test follows the 11.4.1 methodology and whose testers are “a qualified internal resource or qualified external third party” with “organizational independence”. The customized approach objective for 11.4.1 describes testing “by a competent manual attacker”, so ask your QSA before relying on an AI-only pentest.

Service providers carry two extra duties under PCI DSS v4.0.1:

• 11.4.6: segmentation controls are pentested at least once every six months and after any change to them.
• 11.4.7: multi-tenant service providers “cannot forbid penetration testing” and must support customer requests for testing or share their own results. For an MSP that hosts several clients’ card data on shared infrastructure, this rule applies to the MSP, not only to the client.

Does HIPAA require penetration testing?

Not in the current text. As of October 2026, 45 CFR 164.308(a)(1)(ii)(A) requires “an accurate and thorough assessment of the potential risks and vulnerabilities” to ePHI, and 164.308(a)(8) requires a “periodic technical and nontechnical evaluation”, but neither names a pentest (eCFR, 45 CFR 164.308). A pentest is one way to evidence both.

The HHS proposed rule published on January 6, 2025 would change that: proposed 164.312(h)(2)(iii) requires penetration testing “at least once every 12 months” by a qualified person, and proposed 164.312(h)(2)(i)(A) requires automated vulnerability scans at least every six months (Federal Register, 2024-30983). We found no final rule in the Federal Register as of October 2026. Risk analysis is the requirement OCR cites most directly: all three ransomware resolutions we read in full cite it, per our HIPAA enforcement tracker.

Does SOC 2 require penetration testing?

No criterion in the AICPA Trust Services Criteria requires a pentest. Under CC4.1, a point of focus lists “penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments” as evaluation types, and paragraph .04 states that use of the criteria “does not require an assessment of whether each point of focus is addressed” (AICPA, TSP Section 100).

• CC4.1 point of focus: lists penetration testing as one type of ongoing or separate evaluation.
• CC7.1 point of focus: vulnerability scans “on a periodic basis and after any significant change in the environment”.

In practice, your auditor and your customers decide whether pentest evidence is expected, so ask the audit firm in writing which CC4.1 and CC7.1 evidence it will test before you buy a subscription.

What does penetration testing as a service cost in 2026?

Published PTaaS list prices in October 2026 run from $2,999 a year for Astra’s autonomous single-target plan to $27,120 for one Synack14 test, while BreachLock, HackerOne and Cobalt’s credit tiers publish none. The unit differs: Astra charges per target per year; Synack, Intruder, Stingrai and Cobalt Autonomous charge per test; Cobalt’s tiers sell credits worth 8 testing hours.

For hourly-billed engagements, the closest public benchmark is federal contract data. Penetration testing labor categories on GSA schedules have a median ceiling rate of $152.04 an hour across 546 rates, with the middle half between $120 and $193, per our analysis of IT hourly rates from GSA CALC+. Synack states that it “prices based on the testing methodology, test duration and the number of assets tested”, the same three inputs that drive an hourly quote.

What does each testing model cost over three years?

For one PCI-scoped web application with two significant releases a year, PCI DSS 11.4.2 and 11.4.3 trigger three pentests a year. At October 2026 list prices that comes to $31,500 over three years with Intruder AI pentests, if your QSA accepts an AI-led test, $58,383.36 for hourly engagements at the GSA median rate, $61,200 with Stingrai Hybrid tests and at least $92,547 on Synack Standard before its platform fee.

1. Scope: one customer-facing web application with its APIs, which Astra counts as 1 target; what that test should cover under OWASP WSTG and ASVS is set out in our guide to web application penetration testing.
2. Events: 1 annual pentest plus 2 change-triggered pentests a year for 3 years, so 9 pentests in total.
3. Traditional hours: 80 hours for the annual test and 24 hours for each change-triggered test. These are Uptime Report assumptions (10 and 3 tester days), not vendor quotes, and they exclude retest hours under 11.4.4.
4. Rate: $152.04 per hour, the GSA CALC+ median ceiling rate for penetration testing labor.
5. Prices: October 2026 list prices held flat for 3 years; tax, discounts, platform subscriptions and PCI ASV scan fees excluded.

The change trigger alone adds 60% to the hourly bill: rows A and B differ by $21,893.76 over three years, all from the 48 change-test hours a year. The delivery model moves the total further, from $31,500 (row D) to $92,547 or more (row C) for the same 9 tests. Row F is not a like-for-like option: Astra’s features page lists “One pentest (VAPT) per year” for the $5,999 plan, so the six change-triggered tests need a separate quote.

How does release cadence change the answer?

Per-test vendors charge a full test for every significant release, while an hourly firm bills only the change-test hours, 24 in our assumption. That makes release cadence the swing factor: Stingrai Hybrid costs less than hourly testing at 0 or 1 releases a year and more from 2 onward, with the lines crossing at about 1.7 releases, while Synack Standard overtakes the hourly model at about 0.3 releases a year.

At what hourly rate does a per-test vendor win?

Within the GSA middle half of $120 to $193 an hour, 128 testing hours cost $15,360 to $24,704 a year. That sits above both Intruder options and below three Synack Standard tests, so only Stingrai Hybrid’s $20,400 falls inside the band, matching hourly testing at $159.38 an hour. Ask an hourly firm for its blended rate before comparing it with a per-test quote.

What moves the price of a PTaaS contract?

Six inputs set most PTaaS bills: the number of targets, the number of test events a year, how retesting is counted, whether platform access is a separate line, whether prepaid tests expire, and tester seniority. The first five appear explicitly on at least one vendor pricing page we read in October 2026, and all six can be checked before signing.

• Targets. Astra counts one web or SaaS app with its APIs as 1 target, but an Android app and an iOS app as 2. At list price, two Pentest Expert targets would cost $11,998 a year instead of $5,999.
• Test events. On per-test pricing, each change-triggered pentest adds at least $10,283 on Synack Standard, $6,800 on Stingrai Hybrid or $3,500 on Intruder.
• Retest windows. Cobalt’s tier table lists free retesting for 6 months on Standard and 12 months on Premium and Enterprise, while its FAQ on the same page says retesting is unlimited throughout the contract term. Get the retest window in writing, because PCI DSS 11.4.4 requires a repeat test after fixes.
• Platform fees. Synack states that its platform “is required to purchase any of the testing products and is a separate line item”, and also lists a Basic Platform “at no cost” on its October 2026 pricing page.
• Expiry. Cobalt credits “do not roll over into the next contract”, with rollover of up to 10% on Enterprise only, and Intruder pentest packs “must be used within 1 year of purchase”.
• Tester seniority. GSA penetration testing rates rise from $129 an hour at 0 to 2 years of experience to $184 at 10 or more years, a 43% gap.

Which testing model fits your compliance need and release cadence?

Match the model to the strictest rule you answer to, then to how often you ship. If FedRAMP or PCI DSS applies, you need a methodology-driven human pentest at least every 12 months plus scheduled scans, and PTaaS fits when significant changes arrive more than once a year. If no rule names a pentest, automated scanning plus a test before major releases is the floor.

Most PCI programs combine models rather than pick one. Quarterly scans under 11.3.1 and 11.3.2 cover known flaws between tests, and the pentest under 11.4 covers what scanners miss, including the internal and external scope set out in our guide to network penetration testing.

What should you ask a PTaaS provider before you sign?

Ask questions that map to the clauses an assessor will check: methodology (PCI DSS 11.4.1), tester independence (11.4.2 and NIST CA-8(1)), retesting (11.4.4), result retention (11.4.1, 12 months) and, for federal work, FedRAMP recognition. Get the answers in writing, because the contract, not the sales deck, is what your QSA or FedRAMP assessor will read.

1. Which industry-accepted methodology do you follow? PCI DSS 11.4.1 names OSSTMM and OWASP as examples, and FedRAMP references NIST SP 800-115.
2. How many manual pentests a year does the subscription include, and does a change-triggered test use a credit or need a new purchase?
3. How long is retesting included after each test: 6 months, 12 months or the full contract term?
4. Who are the testers, and how do you document organizational independence? PCI DSS 11.4.2 says the tester is “not required to be a QSA or ASV”.
5. Will findings and remediation records stay exportable for at least 12 months, as 11.4.1 requires?
6. Is platform access a separate fee, and do unused credits or prepaid tests lapse after 12 months?

What changes when an MSP buys or resells PTaaS?

An MSP has to settle who signs the report and who holds the client contract before it quotes. The PCI DSS v4.0.1 glossary defines organizational independence as a structure with “no conflict of interest between the person or department performing the activity and the person or department assessing the activity”, so an MSP that manages the client’s network is a weak tester of record. Reselling a vendor whose testers sign keeps that line clean.

Whatever the vendor, write three terms into the client agreement: whose name appears on the attestation letter, report and remediation retention for at least 12 months under 11.4.1, and the retest window under 11.4.4. Where the vendor table says “Not stated”, ask for the answer in the partner agreement itself.

How we compiled this

We compiled this comparison in October 2026 from 29 primary documents: the PCI DSS v4.0.1 standard, the eCFR text of 45 CFR 164.308 and 164.312, the January 6, 2025 HIPAA Security Rule proposed rule, the AICPA Trust Services Criteria (read in its March 2020 edition), the FedRAMP Penetration Test Guidance v3, Rev. 5 baselines and three Consolidated Rules for 2026 pages, NIST SP 800-53 Rev. 5 and SP 800-115, CISA’s Cyber Hygiene page and BOD 20-01, the AWS penetration testing policy, and the pricing and partner pages of Astra, Synack, Intruder, Stingrai, Cobalt, BreachLock, Tenable and HackerOne, plus our own GSA CALC+ rate analysis. We did not test any product or commission any pentest. Costs are list prices or labelled assumptions and exclude tax and negotiated discounts.

Frequently asked questions

Is PTaaS more expensive than a traditional pentest?

The answer turns on how many tests you need. In our worked example of three pentests a year for one web app, hourly testing at the GSA median of $152.04 costs $19,461.12 a year, Stingrai Hybrid $20,400, Synack Standard at least $30,849 before platform fees and Intruder $10,500 at its subscriber price, plus an unpublished platform subscription. Astra’s $5,999 plan covers only one manual pentest a year.

How long does a PTaaS pentest take?

Delivery times differ by model. Astra’s pricing FAQ says its manual pentest takes 10 to 15 working days, Intruder sells a same-day pentest, and Cobalt’s Autonomous Pentest promises findings in 24 hours. Cobalt’s credit tiers start testing within 3, 2 or 1 business days by tier (Cobalt, October 2026). Allow time for the 11.4.4 retest after fixes.

Can PTaaS satisfy PCI DSS and SOC 2 requirements?

Yes for PCI DSS, if the test follows a documented 11.4.1 methodology and the testers have organizational independence under 11.4.2. Ask your QSA about AI-only tests, since the 11.4.1 objective names a competent manual attacker. SOC 2 has no pentest requirement; the AICPA lists penetration testing as one CC4.1 point of focus, so your auditor decides what evidence it expects.

Is an MSP a PCI DSS service provider?

Often, yes. The PCI DSS v4.0.1 glossary lists “managed service providers that provide managed firewalls, IDS, and other services as well as hosting providers” as service provider examples. That status changes testing: an MSP that uses segmentation to isolate cardholder data owes a segmentation pentest every six months under Requirement 11.4.6, and 11.4.7 applies once it is multi-tenant (PCI SSC, June 2024).

Can I show an auditor proof of a pentest before the report is ready?

Some vendors issue interim evidence. Astra’s pricing FAQ says customers get instant access to an “Engagement Letter” certifying that the pentest is under way, and Stingrai’s $6,800 Hybrid Pentest includes an attestation letter for SOC 2, HIPAA and PCI DSS. Ask the auditor or QSA in advance whether a letter is accepted, because PCI DSS 11.4.1 expects the test results themselves to be retained for 12 months.

Do I need my cloud provider’s permission before a pentest?

On AWS, usually not for listed services: customers may test EC2, RDS, Lambda and other “Permitted Services” without prior approval, but testing that includes Command and Control requires approval, and “Resellers of AWS services are responsible for their customers’ security testing activity” (AWS, October 2026). That last line puts an MSP reselling AWS on the hook for the tester it hires.

What is the difference between PTaaS and a bug bounty?

PTaaS buys a scoped test against a defined methodology, with a report that can serve as compliance evidence. A bug bounty pays outside researchers for valid findings in whatever they choose to test within scope. CISA BOD 20-01 notes that bounties may bring more reports and more low-quality submissions, and the directive does not require agencies to run one.

Sources

1. PCI Security Standards Council, PCI DSS v4.0.1 Requirements and Testing Procedures (June 2024). Accessed October 2026.
2. eCFR, 45 CFR 164.308 Administrative safeguards. Accessed October 2026.
3. eCFR, 45 CFR 164.312 Technical safeguards. Accessed October 2026.
4. HHS, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (NPRM, Federal Register 2024-30983, January 6, 2025). Accessed October 2026.
5. AICPA, TSP Section 100: 2017 Trust Services Criteria. Accessed October 2026.
6. FedRAMP, Penetration Test Guidance v3 (June 30, 2022). Accessed October 2026.
7. FedRAMP, Rev. 5 Security Controls Baseline workbook. Accessed October 2026.
8. NIST, SP 800-53 Rev. 5 Security and Privacy Controls. Accessed October 2026.
9. NIST, SP 800-115 Technical Guide to Information Security Testing and Assessment (September 2008). Accessed October 2026.
10. CISA, Cyber Hygiene Services. Accessed October 2026.
11. CISA, Binding Operational Directive 20-01. Accessed October 2026.
12. Astra Security, Pricing. Accessed October 2026.
13. Synack, Pricing. Accessed October 2026.
14. Astra Security, Pentesting features and plans. Accessed October 2026.
15. Intruder, Pentest pricing. Accessed October 2026.
16. Stingrai, Plans and pricing. Accessed October 2026.
17. BreachLock, Pricing. Accessed October 2026.
18. Synack, Managed Security Service Providers partner program. Accessed October 2026.
19. BreachLock, Partner program. Accessed October 2026.
20. Intruder, Become a partner (partnership FAQ). Accessed October 2026.
21. Cobalt, Partners. Accessed October 2026.
22. Astra Security, Partner program. Accessed October 2026.
23. AWS, Penetration Testing policy. Accessed October 2026.
24. Cobalt, Pricing. Accessed October 2026.
25. Tenable, Nessus Professional. Accessed October 2026.
26. HackerOne, H1 Pricing. Accessed October 2026.
27. FedRAMP, Consolidated Rules for 2026: Choosing a Certification Path. Accessed October 2026.
28. FedRAMP, Consolidated Rules for 2026: Definitions. Accessed October 2026.
29. FedRAMP, Legacy Documentation. Accessed October 2026.
30. The Uptime Report, IT Hourly Rates 2026 (GSA CALC+ analysis). Accessed October 2026.
31. The Uptime Report, HIPAA Enforcement Tracker. Accessed October 2026.