Every penetration test generates data that should not be in the wrong hands. Vulnerability details, infrastructure maps, exploit paths, access findings. The whole point of hiring a pentest provider is to surface what attackers could find. That same information, in an unsecured platform, becomes exactly what attackers would want.
This is the platform trust question that matters before anything else in a PTaaS relationship: how does the platform itself protect what is inside it?
Capture The Bug uses Time-Based One-Time Password authentication on every account. Here is what that means, why it matters, and what it protects.
What TOTP Actually Does
TOTP stands for Time-Based One-Time Password. It is a standardised algorithm defined in RFC 6238 and is the authentication method behind Google Authenticator, Authy, Microsoft Authenticator, and most enterprise MFA apps.
When a user sets up TOTP on a Capture The Bug account, the platform shares a secret key with an authenticator app on the user's device. From that point forward, the app uses that shared secret and the current time to generate a six-digit code that changes every 30 seconds. The server generates the same code independently using the same inputs. When the codes match, access is granted.
No network connection is required to generate the code. No SMS message is sent. No email link is clicked. The code lives only on the authenticator app and is valid for a single 30-second window. Once used, it cannot be replayed.
The practical result: even if an attacker captures a user's password through phishing, credential stuffing, or a database breach, the password alone is not enough. They also need the TOTP code, which means they need physical access to the device running the authenticator app, in the current 30-second window.
Why This Matters Right Now in ANZ
Identity-based attacks are the dominant threat pattern in 2026, particularly for organisations in Australia and New Zealand. Barracuda's 2026 threat intelligence, drawn from ANZ-specific incident data, documented a rise in suspicious login activity involving stolen credentials earlier this year. One in 16 suspicious login attempts detected by Barracuda's Managed XDR team in February 2026 originated from Romanian IP addresses, a geographic pattern consistent with coordinated credential stuffing operations.
Identity compromise underpinned 83% of cloud compromises studied in Google Cloud's Threat Horizons Report H1 2026. CrowdStrike's 2026 Global Threat Report placed the average time between initial compromise and lateral movement at 29 minutes, 65% faster than the year prior.
When attackers gain access to a platform account, they move fast. A pentest platform holds live vulnerability data, remediation status, historical findings across multiple engagements, and infrastructure context from every test ever run. That is a high-value target. The authentication protecting it needs to match what is inside. Microsoft's Digital Defense Report 2025 confirmed that MFA blocks more than 99% of identity-based attacks even when the attacker already holds valid credentials. TOTP is not phishing-resistant in the strictest cryptographic sense that FIDO2 hardware keys are, but it closes the gap that passwords alone leave entirely open, without requiring specialist hardware.
How CTB Implements TOTP
Setting up TOTP on a Capture The Bug account takes under two minutes. After navigating to account security settings, a QR code is displayed. Scanning that code in any standard authenticator app, including Google Authenticator, Authy, Microsoft Authenticator, or 1Password, completes the pairing. Every login then requires both the account password and a current TOTP code.
The code is valid for a single 30-second window and cannot be reused. The shared secret is never transmitted during authentication. There is nothing to intercept in transit.
For teams running multiple accounts across an engagement, each account carries its own TOTP setup. No shared credentials. Access can be revoked cleanly when a team member leaves an engagement without affecting other accounts.
This matters for compliance. For organisations evidencing access controls under the Australian Essential Eight, SOC 2, ISO 27001, or the RBNZ cyber resilience guidance for NZ financial sector entities, TOTP on every account creates a clear, auditable authentication layer. The setup date, the MFA method, and authentication event logs provide the evidence trail compliance frameworks ask for. For a deeper look at how continuous testing builds the ongoing compliance evidence base, the guide to penetration testing for SOC 2 and ISO 27001 compliance covers the full picture of what auditors expect to see.
What This Means for Your Data
Every finding your team uploads to the Capture The Bug platform, every vulnerability report, every remediation status update, sits behind an authentication layer that requires two independent factors before access is granted.
Your team's usernames and passwords can be captured in a credential breach without that access translating into platform access. The TOTP requirement breaks the chain between credential compromise and data exposure.
For SaaS organisations running continuous testing programmes, where the platform holds a running history of findings across every sprint cycle, that chain-breaking is not a nice-to-have. The platform holds a map of everything your security programme has ever found. Protecting that map with a single factor, a password, is the kind of misconfiguration that shows up in a pentest report. As documented in our analysis of broken authentication vulnerabilities, authentication failures are consistently among the most exploited access vectors in SaaS environments.
Platform security is not separate from the value of a pentest engagement. It is part of it. The assurance Capture The Bug provides through TOTP on every account is one layer of that commitment. A single stolen password does not become a breach. That is a security outcome, not a feature.
If you want to understand how Capture The Bug protects your engagement data from intake through to remediation, book a platform walkthrough as part of a free security consultation at our Request Demo page.
Your Last Pentest Is Already Out of Date
Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement.
Plan Your Annual Pentesting Strategy the Right Way
Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits.
FAQ
What is TOTP authentication and how does Capture The Bug use it?
TOTP stands for Time-Based One-Time Password, defined in RFC 6238. It generates a six-digit code every 30 seconds using a shared secret and the current time. Capture The Bug requires TOTP on every platform account. After setting up a TOTP app such as Google Authenticator or Authy, every login requires both a password and a current TOTP code. A stolen password alone cannot grant access.
Why does a penetration testing platform need strong authentication?
A penetration testing platform holds vulnerability details, infrastructure findings, exploit paths, and remediation history. That data represents a detailed map of an organisation's security posture. Without strong authentication, a credential breach against one team member could expose every finding from every engagement. TOTP ensures that credential theft does not translate directly into platform access.
Is TOTP secure enough for a security platform in 2026?
TOTP significantly raises the bar over passwords alone. Microsoft's Digital Defense Report 2025 confirmed that MFA blocks more than 99% of identity-based attacks even when attackers hold valid credentials. TOTP codes are valid for 30 seconds, cannot be replayed, and require physical access to the authenticator device. While hardware FIDO2 keys offer stronger phishing resistance, TOTP closes the primary credential theft attack vector without requiring specialist hardware.
Can TOTP on the Capture The Bug platform help with compliance?
Yes. TOTP on every account creates a documentable authentication layer that supports compliance requirements under the Australian Essential Eight, SOC 2, ISO 27001, and the RBNZ cyber resilience guidance for New Zealand financial entities. Each authentication event is logged, and the TOTP setup provides the MFA evidence auditors look for when reviewing access controls over systems holding sensitive security data.
How do I set up TOTP on my Capture The Bug account?
Navigate to account security settings and scan the displayed QR code with any standard authenticator app, including Google Authenticator, Authy, Microsoft Authenticator, or 1Password. The process takes under two minutes. From that point every login requires a current TOTP code in addition to the account password.
