Release Guard · Continuous pentesting
An annual pentest is a photo. Your software is a film.
Your team ships new features every few weeks. A full security test happens, at best, once a year. Everything that changes in between goes to production untested — and new code is exactly where most vulnerabilities are born. Release Guard closes that gap: continuous pentesting, release by release, by the same senior who knows your application.
The gap nobody tests
Between two annual tests your team spends months building new endpoints, changed authorisation and updated dependencies. Those changes carry the most risk and get the least testing. A pentest from March knows nothing about what you deploy in September.
What Release Guard does
- Delta test after every release. Focused on what changed, within five working days of your notice. Findings straight into your backlog, with proof of concept and CVSS.
- Thinking along before you build, on request, for the features that touch security: login, authorisation, data handling, payments, integrations. Removing a mistake at design time costs a fraction of the same problem in production.
- Everything in the Annual plan. The focused interim test, the full annual test with retest and attestation letter, the fix sessions and the answers to your auditor.
- Every quarter, a thirty-minute meeting. Whether the time budget still fits, what is coming, what changes.
How it works, every sprint
- Think — at the design stage of security-relevant features.
- Test — after the release, on the change.
- Return — to your backlog, the same week.
- Adjust — in the quarterly meeting.
Instead of checking the door once a year, I check it every time you add a door or a window. One senior. No sales layer, no juniors on your application.
What it costs
€3,000 a month, excluding VAT, fixed. Up to two days of work a month — enough for one to four releases — planned by mutual agreement; unused days stay available within the contract. If more is needed, for big releases or more than four a month: an extra day costs €1,250, always agreed up front. Six-month minimum, monthly thereafter.
For comparison: a security engineer on staff costs €8,000 or more a month. Release Guard is the part of that job you actually need, at the moments that matter.
What it doesn't include
Building fixes, filling in complete customer questionnaires, a second application (fixed surcharge). Answering a technical question is always included.
What went to production untested?
Send me your release notes from the past six months. Within a week you get a thirty-minute call in which I tell you which releases I would have wanted to see — and why. Then you decide whether you need this.
FAQ
Frequently asked questions
How many releases does Release Guard cover?
One to four a month, within the two days. With four releases that is half a day per release — exactly what a focused delta test is. Above that, or with big releases, we agree an extra day up front.
Does it replace the annual pentest?
No. It is included and remains the baseline. The delta tests keep you current between two full tests.
You have tested me before. Do we have to repeat the full test?
No, if that test is less than six months old. Then it counts as the starting point and Release Guard starts directly with the releases since that test.
Send me your release notes, or book a 30-minute call.
Book a scoping callPrefer email? Send your scope to info@hacketico.es — within 24 hours on working days you'll know whether it fits in 5 days and what it costs.