PENETRATION TESTING AS A SERVICE (PTaaS)
Penetration Testing & Ongoing Cybersecurity Assessments
We find the weaknesses attackers look for — before they do. Automated monitoring watches your internet-facing systems between tests, and a specialist manually tests what matters. One fixed monthly fee.
Authorized, scoped testing. Plain-English reports.
Human-verified findings
Every reported issue is manually confirmed
Retests included
Fixed findings re-checked in every tier
Scheduled monitoring
Runs at the frequency your plan defines
Quote in 2 business days
Fixed price, scope agreed in writing
What We Monitor
Everything you expose to the internet.
External Asset Discovery
Your domains, subdomains, IP ranges and internet-facing services — found, mapped and kept up to date.
Websites & Web Applications
Portals, booking systems and public apps tested for access-control, session and injection flaws.
Outdated WordPress & CMS Plugins
Identifiable plugin, theme and CMS versions checked against known vulnerabilities.
Publicly Exposed Services
Admin panels, database consoles, remote access and test environments that should not be public.
Security Misconfigurations
Default credentials, debug output, weak TLS and missing security headers.
Known CVEs
Discovered technologies matched against newly published vulnerabilities.
How PTaaS Works
Scanners find the obvious. People find the rest.
Automation catches changes quickly but cannot judge real-world exploitability. Manual testing can. PTaaS uses both.
Attack Surface Monitoring
Runs on the schedule your plan defines. Flags new subdomains, newly opened ports and newly published vulnerabilities as your systems change.
Hands-On Penetration Testing
A specialist tests login, access control and business logic within the agreed scope, and confirms which issues are genuinely exploitable.
HEALTHCARE SPECIALIZATION
Security for clinics, practices and healthcare providers.
Hospitals, clinics and dental practices rely on booking systems, patient portals and websites that are exposed to the internet. We monitor and test them without touching patient records or disrupting care.
Fixed Monthly Retainers
One flat fee. A clearly defined scope.
A one-off audit is out of date as soon as your site changes. A retainer keeps checking.
Small External Pentest
from $4,000USD / month
External, internet-facing testing
- Authenticated and unauthenticated testing of public-facing services
- A written report ranking every finding by exploitability
- 30-day retest of fixed findings, included
Best for: Single-location SMBs and first-time or compliance-driven tests
Request a quoteMedium Full Pentest
from $6,500USD / month
External plus internal network testing
- Everything in Small, plus testing from inside the network
- Active Directory enumeration and privilege-escalation testing
- Executive summary, technical findings, and a remediation roadmap
- 30-day retest of fixed findings, included
Best for: HIPAA or PCI scoped environments and repeat clients
Request a quoteLarge Enterprise Pentest
from $10,000USD / month
Full scope: external, internal, web app, and phishing
- Web application testing and a phishing simulation
- Active Directory enumeration with lateral-movement testing
- An executive briefing call to walk leadership through the results
- 60-day retest of fixed findings, included
Best for: Multi-location businesses and SOC 2 audit prep
Request a quoteOur Process
Discover → Assess → Report → Monitor & Verify
Four stages, repeated every month.
- 01
Discover
We map the internet-facing systems you have authorised us to test.
- 02
Assess
Automated checks run on schedule; a specialist manually tests within the agreed scope.
- 03
Report
What we found, how serious it is, the evidence, and how to fix it.
- 04
Monitor & Verify
We re-test your fixes and keep watching for new exposures.
ACTIVE THREAT RESEARCH
The PHP2Shell flaw: how web enumeration stops mass compromise.
Automated scanning campaigns are targeting exposed PHP endpoints, legacy staging scripts, and unvalidated upload handlers across the globe — dropping interactive web shells that grant immediate remote code execution.
Standard scanners miss these entry points because they lurk on unlinked subdomains and forgotten directories. Dex Security’s web enumeration service finds every exposed asset, identifies the vulnerable scripts, and delivers the exact remediation needed before an attacker gains access.
01 · Reconnaissance
Shadow Subdomain & Directory Mapping
We discover orphaned subdomains, historical DNS records, and unlinked directories where legacy PHP scripts reside unmonitored.
02 · Detection
Web Shell & Upload Vector Identification
We probe exposed upload handlers, FastCGI configurations, and server paths for executable permissions and signs of compromise.
03 · Remediation
System Hardening & Continuous PTaaS
We implement execution restrictions, lock down hazardous PHP functions, and keep continuous watch through monthly retainers.
Frequently Asked Questions
Everything you need to know about PTaaS & security assessments.
What is Penetration Testing as a Service (PTaaS)?
Penetration Testing as a Service (PTaaS) combines continuous automated attack surface monitoring with recurring manual penetration testing on a predictable monthly retainer. Instead of waiting for an annual audit, your systems are continuously checked as code, plugins, and cloud infrastructure change.
How does recurring testing differ from a one-off penetration test?
A one-time penetration test provides a static snapshot of security at a single point in time. A monthly retainer provides ongoing surveillance, scheduled in-depth testing by human specialists, and included retesting of fixed findings to ensure security keeps pace with ongoing updates.
Do you test healthcare, dental, and medical practice websites?
Yes. We specialize in external security testing for healthcare clinics, private practices, and dental organizations. We rigorously evaluate patient portals, booking forms, and web applications without accessing private medical records or disrupting clinical care.
What deliverables and reports do clients receive?
Every assessment delivers an executive summary for non-technical decision-makers, a prioritized technical report with evidence and severity ratings for each finding, and code-level remediation guidance that IT teams or developers can act on immediately.
Can penetration testing take our website or booking systems offline?
No. Our testing is carefully scoped, safe, and non-destructive. We do not run denial-of-service tests or alter live database records. Testing is performed in full accordance with written rules of engagement.
How quickly can our organization get started?
After you submit your target domains or applications, we clarify your scope and provide a transparent, fixed-fee quote within two business days. Once authorized, initial reconnaissance begins immediately.
TAKE THE NEXT STEP
Understand Your Security Risks Before They Become Business Problems
Request a consultation to discuss your website, applications, and ongoing security requirements. We clarify your perimeter, review high-priority risks, and establish ongoing protection.