AccessGranted Continuous Monthly pentest subscription
Automated pentest of your attack surface every month, with real exploit attempts rather than signature matching. Once a month your pentester sits down with you, goes through the results and prioritizes with you what matters next.
As an add-on to your annual pentest, or as your entry into pentesting while the big test still has to wait.At month end
Your pentester goes through the results with you, puts them in context and prioritizes.
repeats every month
If you already test once a year, Continuous covers the months in between. If you are not there yet, you start with it.
The add-on
The annual pentest goes deep on a fixed date. Continuous keeps testing in the months in between, re-checks your fixes and keeps you in touch with your pentester.
The entry point
Because the budget is not there right now, or because you are still rebuilding. With Continuous you start anyway: an automated pentest with real exploits every month, plus a review with your pentester.
Two things we hear a lot
“We don't have the budget for a big pentest right now.”
“We're still rebuilding. We'll do the pentest once everything is finished.”
We have often seen pentests get postponed. This year's budget is already allocated, the ISMS is not finished, the migration is still running. That is understandable. But attackers don't wait until you are ready. Continuous is our answer: real exploits every month, a pentester who goes through the results with you, and a price that fits a tight budget.
Doing something beats doing nothing.
Continuous does not replace an in-depth manual pentest. It makes sure your systems do not go untested until then.
A pentest. The platform attempts the exploit instead of only reporting the version number.
Exploitable? Unknown.
A vulnerability scanner matches signatures. It detects a software version, looks up the matching CVE numbers and writes them into a list. Whether the flaw is actually exploitable in your environment stays open.
Exploitable? Answered.
Our testing platform goes one step further. It runs real exploit attempts, follows privilege escalation paths, for example in your Active Directory environment, and documents whether and how far an attacker would get. In the end you know which vulnerabilities actually matter in your environment.
External endpoints are tested monthly. The cadence for internal exploit runs, especially in Active Directory, is agreed with you during scoping and may be somewhat lower depending on scope and criticality.
Your pentester goes through the results with you in person – on a monthly rhythm.
The platform delivers findings.
What they mean for your company gets settled in conversation.
That is why every cycle includes a meeting with an AccessGranted pentester: a fixed point of contact who gets to know your environment over time and can judge which finding is actually critical for you.
Many scanning and attack simulation platforms stop at the dashboard.
Questions go through a ticket or a chatbot.
With us, someone who knows the results sits across from you and answers.
How the review meeting runs
What is new, what is fixed, what has come back.
A CVSS score does not know your processes. The pentester assesses what a finding means in your environment.
What your IT tackles next and what can wait.
Your IT asks, the pentester answers. In conversation, with your systems in view.
So the next cycle shows whether the measures worked.
“Florian was available to us as a competent point of contact at all times, answered questions quickly and thoroughly, and supported us in prioritizing and implementing appropriate measures.”
The platform keeps testing, you can see the current state at any time, and fixed findings are automatically re-checked in the next cycle.
next cycle
Status live at any time in app.access-granted.de
Status, findings and history at any time in your existing customer platform app.access-granted.de, not just in the final report.
Every fixed vulnerability is tested again in the next cycle. No extra quote, no re-commissioning.
The same pentester you know from the review meeting remains your point of contact.
ASM automatically checks what's visible from the outside: subdomains, open ports, certificates, and domains that look confusingly similar to yours. That adds the outside view between cycles to complement the exploit tests.
Subdomains, open ports and running services are captured automatically, including the ones nobody remembers are still online.
Expiring certificates, exposed config files and API keys left in the code show up before they turn into an incident.
Automatic, once a week per domain. That's enough to catch new subdomains, expiring certificates, or freshly registered look-alike domains in time.
Bookable as an add-on to Continuous or entirely on its own, with no external or internal endpoints required.
Enter your endpoints and ASM domains, pick a term, see the result instantly. The service fee covers the platform, reporting and the monthly review meeting.
Please select your endpoints and term first so we can put together a matching quote.
Externally reachable systems, e.g. web servers, VPN gateways, mail servers.
Internal endpoints incl. Active Directory environment. We align testing depth (e.g. AD exploit runs) with you during scoping, possibly at a reduced cadence depending on scope.
Domains monitored under Attack Surface Management. Can be booked without any external/internal endpoints.
Contract term
Due once when booking at least one internal endpoint, not part of the monthly rate.
All prices are net, plus statutory VAT. This offer is aimed exclusively at businesses within the meaning of Section 14 of the German Civil Code (BGB).
A classic annual pentest is a thorough, deep assessment at a fixed point in time – and the right choice for many needs. Continuous spreads that depth across the whole year and adds re-tests plus a monthly conversation.
Classic annual pentest1× a year, in full depth
AccessGranted Continuous12× a year, automated
Classic annual pentestAvailable as a separate project
AccessGranted ContinuousIncluded, every cycle
Classic annual pentestPDF report by email
AccessGranted ContinuousMonthly meeting with your pentester
Classic annual pentestFull-depth assessment on the agreed date
AccessGranted ContinuousExploit and privilege escalation, fresh every month
Classic annual pentestIn the report at project close
AccessGranted ContinuousLive on app.access-granted.de
Test scope, systems, framework conditions: 30 minutes that make the rest plannable.
Access and approvals for the automated testing platform, set up.
Full baseline test, including report and initial discussion.
On test cadence, outage risk, NIS2, contract term and getting started.
External endpoints are tested automatically on a monthly rhythm. For internal testing depth, especially Active Directory exploit runs, we align the exact cadence with you during scoping. Depending on scope and criticality, a slightly reduced rhythm can make sense here.
Regardless of cadence: findings already reported are automatically re-verified (re-tested) in the following cycle, without you having to commission that separately.
We proceed in a controlled manner. Before the first test cycle, we jointly define rules of engagement: critical systems, maintenance windows, and escalation paths. Our automated testing platform is designed for stability and uses safety checks before executing riskier actions such as privilege escalation attempts.
A residual risk can never be fully excluded with real exploit simulation. That is why we deliberately align testing depth and scope with your environment during scoping, rather than running everything unfiltered on every system.
AccessGranted Continuous provides you with regular, documented test results and reports that can serve as a building block for evidencing the continuous effectiveness of your security measures, for example in the context of NIS2 (Art. 21) or Section 30 BSIG. For operators of critical facilities, they are a basis for the evidence under Section 39 BSIG, which itself is provided through security audits, examinations or certifications. Once a year, we also issue you a certificate confirming that the pentest was carried out continuously throughout the year.
Whether and in what form this is sufficient for your specific compliance evidence depends on your individual situation. We recommend aligning this with us during the first call and, if needed, with your legal advisor. We do not replace legal advice.
You start on a 1-year term by default, with no discount. Book 3 years and your monthly rate drops by 5%; 5 years drops it by 10%. The discount applies only to the recurring monthly rate, not to the one-time setup fee for internal endpoints.
Which term makes sense depends on how confident you are about your needs over the next few years. Growing companies with a changing endpoint count often prefer the flexibility of 1 year, while a stable footprint makes the discount add up significantly over the term. We are happy to advise you on this during the first call.
No, and it is not meant to. On selected systems, a manual pentest goes to a depth an automated test does not reach. Physical, social engineering and red teaming remain separate tests anyway.
Continuous is the ongoing add-on to that, or your entry point while a big pentest is not feasible yet. When it comes later, Continuous keeps running as a safeguard between tests.
We advise against waiting until then. During a rebuild, old and new systems often run side by side, and temporary solutions stay longer than planned. Those are exactly the spots attackers use. Continuous shows you already in this phase what is exploitable from outside and in the internal network, and the findings feed straight into the rebuild instead of being patched up afterwards.
Which systems belong in the test during the rebuild is something we clarify during scoping. You schedule the big pentest once everything is in place.
Free first call: together we look at whether Continuous fits you as an add-on or as an entry point, and show you what a review meeting would look like.
