// GLOSSARY

Continuous Penetration Testing

An offensive assurance program of at least three months, managed with planned monthly validation sprints and a fix-verify cycle. It is neither a one-off test nor an unlimited service; it is a planned rhythm within package limits. The concept's rationale arises from the mismatch between the traditional annual penetration test and modern development pace. An application now changes not once a year but many times a week or a day; each deployment can bring a new vulnerability. A test done once a year gives a photograph of the day it was done, but that photograph begins aging the moment it is taken, and a blind span forms across the eleven months until the next test. Continuous Penetration Testing closes this blind span: it takes security out of being an event and turns it into a process. Two things form its backbone: measurable closure, that is, tracking found vulnerabilities not to the point of being found and left but to verifiable closure, and monthly management visibility. What separates it from a one-off test is the time axis; each month the security posture turns into a trend line and the mean time to remediate (MTTR) into a performance indicator.