Somewhere in the last eighteen months, penetration testing quietly stopped being an event. In November 2026, the serious offerings don't sell you a test — they sell you a standing process. RunSybil's November changelog is titled, tellingly, "Continuous Coverage": their agent rolls every shipped change into a new test on a cadence the customer chooses. Novee shipped External Surface Testing the same week — discovery that never sleeps, promoted into a full pentest when an asset warrants it.
This isn't a feature race. It's the market admitting what operators have known for years: an annual test measures a surface that stopped existing months ago. The estate churns — subdomains appear on a Tuesday, a review app gains production credentials on a Thursday, an IdP group mapping drifts on the weekend. A report written in March describes a company you're no longer defending.
What continuous actually means
Continuous is easy to say and hard to mean. Done honestly, it's a loop with three working parts:
- Detect. The swarm watches the surface for change — new DNS records, cert transparency entries, deployed previews, dependency diffs — not "vulnerabilities," change. Change is what creates attack paths.
- Test. On your cadence — daily, per-deploy, weekly — deltas roll into a bounded test. Black-box re-crawl, white-box repo diff, or both. Approval gate optional, audit trail mandatory.
- Prove. Findings still carry the same standard: chained, demonstrated, signed by an operator. Continuous coverage with continuous noise is just a faster scanner.
# engagement config — continuous tier cadence: on-change # daily | on-change | weekly signals: [recon-diff, repo-diff] # black-box + white-box approval: queue-and-approve # or just-run-it proof_bar: chain-required # nothing ships unproven kill_switch: 15min # always
The honest caveats
Continuous offense still needs human judgment in two places. First, approval: "just run it" is right for most deltas and wrong for some — a major auth refactor deserves an operator's eyes before the swarm touches it. Second, noise discipline: a daily feed only works if the findings are real. Our bar stays where it's always been — if the path isn't demonstrated, it doesn't reach your inbox.
The annual pentest isn't dead; it's been demoted to a compliance artifact. The thing that actually finds the way in is running all the time now. The only question is whether it's running for you or against you.