PTaaS — Web Application Pentest Subscription
An application changes with every release, while a one-off pentest describes its state on a single day. With a PTaaS subscription you book test dates in advance, order change tests after releases, delivered within 5 business days of the request, and we verify fixes with unlimited retests. The outcome of every test is a report.
Describe your scope — your account manager will reply within 24 hours.
- From €5,700/year net
- Delivery: 12-month subscription
- Free quote
What is PTaaS at nFlo?
It is an annual subscription for penetration testing of a single web application. Over the year we perform 1 full test and 3 change tests, you book test dates in advance, for example before a new release, and retests of fixes are unlimited and included in the subscription price. A change test covers new and modified features since the previous test and we deliver it within 5 business days of the request. The outcome of every test is a report.
Contact your account manager
Discuss PTaaS — Web Application Pentest Subscription with your dedicated account manager.
One pentest a year cannot keep pace with application releases
Testing planned around your release calendar
Booked test dates
We agree test dates in advance, so the test is ready before the release, not weeks after it
Change tests
3 tests a year covering new and modified features since the previous test, within 5 business days of the request
Unlimited retests
We verify every fix within the subscription price, with no extra charge for further rounds
What is PTaaS at nFlo?
PTaaS (Penetration Testing as a Service) at nFlo is an annual subscription for penetration testing of a single web application. Over the year we perform 1 full test and 3 change tests, you book test dates in advance, and retests of fixes are unlimited and included in the subscription price. The outcome of every test is a report. We explain the PTaaS model itself in our glossary.
| Attribute | Description |
|---|---|
| Subject | 1 web application (Start: up to 20 endpoints; Growth: up to 50 endpoints + API) |
| Tests per year | 1 full test + 3 change tests |
| Retests | unlimited, included in the subscription price |
| Outcome | a report from every test |
Why one pentest a year is not enough with frequent releases
A one-off pentest describes the application as it was on the day of the test. Every subsequent release adds new features, endpoints and permission changes that the test no longer covered. With several releases a year, the report from the latest pentest quickly stops describing the application running in production.
The second problem is timing. When the release is ready but the test still has to be ordered, priced and scheduled, the team has to choose between delaying the release and shipping without a test. The subscription addresses both problems: test dates are booked in advance, and change tests cover what has been added since the previous test. We compare both models in the article PTaaS vs traditional pentest.
What the subscription includes
- Test dates booked in advance: at the start we agree a test calendar aligned with your release plan, for example a test before a planned release.
- Full application test: once a year, within the scope of the BASIC (Start) or STANDARD (Growth) package — the same scope as in our one-off web application penetration testing.
- 3 change tests a year: new and modified features since the previous test, within 5 business days of the request.
- Unlimited retests: we verify every fix within the subscription price.
The outcome of every test, full or change test, is a report.
Change test (delta)
A change test covers new and modified application features since the previous test. We do not repeat the full test; we check what has been added or changed in subsequent releases. We deliver the test within 5 business days of the request, so it fits the typical period between closing a release and deploying it.
The subscription includes 3 change tests a year. Fixes for vulnerabilities found in a change test are verified in the same way as after the full test — as part of the unlimited retests.
What the subscription does not cover
The subscription applies to one application within the scope of the BASIC or STANDARD package. Outside it are:
- applications within the ADVANCED package scope and testing of several applications — quoted individually,
- source code review — a separate source code vulnerability review service,
- testing of standalone API services — web services and API security testing,
- continuous infrastructure scanning — IT vulnerability management.
Subscription price and scope
| Package | Scope | Tests per year | Net price |
|---|---|---|---|
| Start | 1 application with up to 20 endpoints, BASIC package scope | 1 full test + 3 change tests | from €5,700/year |
| Growth | 1 application with up to 50 endpoints + API, STANDARD package scope | 1 full test + 3 change tests | from €9,400/year |
| Beyond | ADVANCED scope, several applications | agreed in the offer | quoted individually |
| Attribute | Value |
|---|---|
| Price | from €5,700/year net (Start), from €9,400/year net (Growth) |
| Term | 12-month subscription (minimum) |
| Retests | unlimited, included in the subscription price |
| Change test | within 5 business days of the request |
| Team certifications | OSWE, OSCP, eWPT |
| Outcome | a report from every test |
| Beyond the Growth scope | quoted individually |
Contact us to agree the application scope and the test calendar for the first year.
Who is it for?
This service is for you if:
- your SaaS team ships new application versions several times a year,
- enterprise customers ask you about a current pentest in their security questionnaires,
- you need a test date before the release, not several weeks after it,
- you want to verify fixes without a separate order for every retest.
Related concepts
Learn more about the key concepts related to this service:
How we work
Our proven service delivery process.
Scope and test calendar
We agree the application, the Start or Growth package and the test dates for the year, aligned with your release plan
Full application test
We perform a full test within the scope of the BASIC (Start) or STANDARD (Growth) package and deliver a report
Change tests after releases
After a requested release we test new and modified features since the previous test, within 5 business days of the request
Fix retests and report
We verify fixes with unlimited retests; the outcome of every test is a report
Benefits for your business
What you gain by choosing this service.
Fixed annual price
From €5,700 net per year: a full test, 3 change tests and retests in one amount
A test date before the release
You book the test ahead of time, so you are not hunting for a free slot when the release is ready
Fixes verified at no extra cost
Unlimited retests within the subscription price — another round of fixes does not mean a new order
An up-to-date pentest report
When a customer security questionnaire asks about your latest pentest, you answer with a current report
Related Articles
Expand your knowledge with our resources.
Free Ministry of Digital Affairs cyber training in November 2026: schedule and how to prepare
Poland's Ministry of Digital Affairs has opened registration for five free online cybersecurity trainings for entities in the national cybersecurity system, including local governments. We have collected the schedule with sign-up links and explain whom to send, what to ask the experts and what to do after each session.
Read more →PHP2Shell and Node2Shell: virtual patching before you deploy the fixes
Within two days CISA added two PHP flaws known as PHP2Shell and a Google Brotli decoder flaw called Node2Shell to its KEV catalog. We explain who is affected, which versions fix them and how virtual patching protects applications before the fixes reach every server.
Read more →What's coming in baramundi Management Suite 2026 R2
baramundi has announced the 2026 R2 release for November 2026 and shifts the focus from choosing between baramundi and Intune to having both tools work together. We have summarised what is set to change, what is being retired and what to check before upgrading — keeping in mind that this is a preview, not a finished release.
Read more →Frequently Asked Questions
Common questions about PTaaS — Web Application Pentest Subscription.
How much does PTaaS at nFlo cost?
The Start package costs from €5,700 net per year and covers 1 application with up to 20 endpoints within the scope of the BASIC package. The Growth package costs from €9,400 net per year and covers 1 application with up to 50 endpoints + API within the scope of the STANDARD package. Both packages include 1 full test and 3 change tests a year, unlimited retests and test dates booked in advance. The minimum subscription period is 12 months.
What is a change test and how long does it take?
A change test (delta) covers new and modified application features since the previous test. We deliver it within 5 business days of the request. The subscription includes 3 change tests a year, in addition to the full test.
How many retests does the subscription include?
Retests are unlimited and included in the subscription price. You submit a fix for a vulnerability found in the full test or in a change test for verification at no extra cost, including when another round of fixes is needed.
How do you book test dates?
At the start of the subscription we agree a test calendar aligned with your application release plan. You book a test date in advance, for example before a planned release, so you do not have to order a new test from scratch when the release is ready.
How does the subscription differ from a one-off pentest?
A one-off pentest in the BASIC, STANDARD or ADVANCED package is a single engagement with a report and a retest after fixes. The PTaaS subscription spreads testing across the whole year: it includes a full test within the BASIC or STANDARD scope, 3 change tests after releases, unlimited retests and test dates booked in advance, for a fixed annual price.
What is the outcome of a test?
The outcome of every test, full or change test, is a report describing the vulnerabilities found, with remediation recommendations.
What if the application goes beyond the Growth package scope?
Applications within the ADVANCED package scope, testing of several applications or a larger number of tests a year are quoted individually.