Penetration testing, managed from scope through remediation.
Bring human-led testing, QA-reviewed findings, reports and remediation into one engagement workspace. Testing cadence, effort and retests are agreed for your program.
From scope to retest.
The scope and authorized methods are agreed for the program.
Security, AppSec and engineering teams managing recurring testing needs.
- 01
Scope
- 02
Test
- 03
QA and delivery
- 04
Remediation
- 05
Retest
Start with an agreed scope
Define the application, API, cloud, network or specialist environment to assess, along with access, exclusions and authorized methods. Your agreement sets the testing effort and cadence. The platform keeps the scope, findings, remediation and retests for every engagement in one place.
TrekShield PTaaS is how we deliver and manage penetration testing. Engagements, QA-reviewed findings, reports, remediation and retests are managed in TrekShield’s own platform.
Experts conduct the assessment
Human testers investigate the agreed scope, assess business logic and record findings with evidence. QA review separates working material from customer deliverables.
Critical issues reach you during testing
Before testing starts, we agree who hears about a critical issue and how, so urgent problems reach your team during testing rather than waiting for the report.
QA review before release
Findings are released to the client after QA when the engagement is delivered. From delivery, remediation status, SLA tracking, retest requests and results, and published reports are managed in the platform.
Remediation and retests in one place
Assign and track remediation work against released findings. Request retests and keep the results alongside the original evidence.
Retests are requested and tracked in the platform. The included number, eligibility window, and any billable additional cycles are stated in the engagement agreement.
Reports for the people doing the work
Discuss technical reporting, executive summaries and supporting review evidence during scoping. Report contents reflect the agreed assessment and released findings.
Compliance mapping is informational; it does not certify your organization or guarantee an assessor’s decision.
Integrations with clear boundaries
The platform includes API keys and signed webhooks. Webhook configuration is API-only in the current documented workflow.
Jira and ServiceNow create one-way tickets in single-client workspaces; the integration docs list supported setups.
Access and audit controls
Role- and attribute-based access, client workspaces and evidence hashes support the engagement workflow.
SSO and SCIM are not available today; the Trust Center lists current access controls.
A program with defined terms
Published annual list prices. Your quote confirms scope, testing cadence, tester effort, and included retest terms.
Engagement contacts and communication arrangements are confirmed during scoping. A dedicated lead or standing team is included only where the plan or quote states it.
Who does what.
| People and responsibilities | Platform |
|---|---|
| Agree scope, safety and objectives | Record scope and engagement state |
| Conduct manual and business-logic testing | Organize findings and evidence |
| Judge severity and perform QA | Support reports and controlled publication |
| Advise on fixes and evaluate retests | Track owners, status, SLAs, requests and results |
PTaaS — questions buyers ask.
Is PTaaS the same as continuous automated scanning?
No. TrekShield PTaaS combines human-led testing with an engagement platform. Testing scope, effort and cadence are agreed; automated scanning does not replace human assessment.
Can we see findings while testing is underway?
Customer findings are released after QA when the engagement is delivered. Agree how urgent issues will be communicated before delivery during scoping.
Do we need an annual program for a single test?
No. Discuss a scoped engagement if that is the appropriate fit. Annual PTaaS is intended for an agreed ongoing testing program.
Does the platform automatically trigger a test from CI/CD?
Not today. Engagements are scoped and scheduled with TrekShield; pipeline-triggered testing is not part of the current product.
Define the right scope.
Security, AppSec and engineering teams managing recurring testing needs.