Introduction

Penetration testing, often referred to as ethical hacking, is a cybersecurity assessment in which security professionals simulate real-world cyberattacks to identify vulnerabilities in an organization’s systems, applications, and networks. Unlike automated security scans, penetration testing involves skilled professionals who think like attackers and uncover vulnerabilities that could be exploited by malicious hackers.

In this article, we’ll explore the different types of penetration tests—compliance-driven, penetration testing as a service (PTaaS), and threat-led testing. We’ll discuss when and why each type is necessary, who benefits from them, and how to determine the best option for your organization’s specific security needs.

Compliance-driven penetration testing

A compliance-driven penetration test is designed to meet regulatory and industry security requirements, such as PCI-DSS, HIPAA, ISO 27001, or SOC 2. Its primary goal is to ensure an organization’s security controls align with mandated standards, helping to avoid fines, legal risks, and reputational damage.

Key aspects of compliance-driven testing:

• Framework-Based Assessments – Ensures critical assets are tested against known vulnerabilities and security best practices.
• Regulatory Compliance – Helps organizations pass audits and meet legal obligations.
• Risk Identification – Detects security gaps before they can be exploited by attackers or flagged by regulators.
• Ideal for Data-Sensitive Organizations – Essential for businesses handling sensitive financial, healthcare, or customer data.
• Assurance & Risk Mitigation – Strengthens overall security posture while ensuring compliance.

Penetration Testing as a Service (PTaaS)

PTaaS is a continuous approach to security testing that combines automated scanning with manual testing on an ongoing basis. Unlike traditional, one-time penetration tests, PTaaS offers:

• Real-time vulnerability detection with continuous monitoring
• Remediation guidance through a cloud-based platform
• Scalable security assessments suited for dynamic environments (e.g., SaaS, DevOps)
• Improved collaboration between security and development teams
• Cost-effective testing that adapts to evolving threats

Challenges and Limitations

• Regulatory concerns – Some industries and compliance bodies may not accept PTaaS as a valid substitute for traditional pentesting.
• Legal liability – Organizations must clearly define responsibilities to avoid risks from unintended service disruptions or data exposure.
• Limited manual testing – While PTaaS includes expert-led assessments, it may not fully replace deep, manual penetration testing for complex attack scenarios.

Threat-Led Penetration Testing

Threat-led penetration testing focuses on simulating real-world attack scenarios based on current threat intelligence and adversary tactics. Unlike compliance-driven or automated testing, this approach tailors assessments to an organization’s specific risks, industry threats, and attack surface.

The Digital Operational Resilience Act (DORA) mandates Threat-Led Penetration Testing (TLPT) for financial entities within the EU to strengthen cybersecurity resilience. TLPT under DORA must:

• Follow a Risk-Based Approach: Testing must be tailored to the organization’s threat landscape, focusing on critical systems and real-world attack scenarios.
• Be Conducted by Accredited Providers: Independent, qualified testers must perform the assessment to ensure credibility and compliance.
• Include Live Threat Simulations: Ethical hackers must replicate tactics used by real adversaries to test detection and response capabilities.
• Cover Critical ICT Assets: Testing must target key information and communication technology (ICT) systems that are essential to business operations.
• Be Performed at Least Every Three Years: Regular TLPT ensures continuous adaptation to evolving cyber threats.
• Ensure Supervisory Oversight: Regulatory bodies must be informed, and findings should be addressed with remediation plans.

DORA’s TLPT framework aligns with established methodologies like TIBER-EU and CBEST, ensuring financial institutions are prepared against sophisticated cyber threats.

What we offer

As we’ve seen, different business needs call for different types of penetration testing. While we offer traditional pentesting solutions, our approach goes beyond conventional methods.

In a typical penetration test, the scope is often limited to a specific web or mobile application, focusing on application or infrastructure-level vulnerabilities. However, we take a more collaborative approach, working closely with clients to analyze their entire infrastructure and architectural solutions. This deeper understanding allows us to uncover unique security risks that arise from the client’s specific environment.

Traditional pentests provide a snapshot of security at a single point in time, while Pentest-as-a-Service (PTaaS) may not always be feasible—especially in development or UAT environments where legal obligations restrict external access via VPN.

To address these challenges, we offer continuous engagements, allowing clients to prioritize different focus areas for testing over time. This approach ensures ongoing security feedback across various elements of the client’s systems.

By maintaining long-term familiarity with a client’s infrastructure and fostering close collaboration, we can provide more tailored security recommendations. During the scoping phase, we help determine which modules, systems, or components should be prioritized, excluded, or even expanded—ensuring the most effective and comprehensive security assessment possible.