A fintech company in Christchurch had a problem familiar to every fast-moving product team in the ANZ region. Their enterprise sales pipeline was moving faster than their security programme. Three deals in one quarter required penetration test evidence within weeks of the request landing. Under the traditional model, that meant three separate vendor engagements, three separate scoping conversations, three sets of scheduling negotiations, and three separate waits for final reports.
Each engagement took four to six weeks end to end. The sales team needed evidence in two.
The company ended up doing what too many ANZ businesses do in this situation: they delayed two deals, accepted terms on the third without the security evidence in place, and then spent the next quarter managing the compliance documentation they had promised and not yet delivered.
The problem was not that the testing was unavailable. The problem was that security testing, in its traditional form, is not built to move at the speed of a modern sales cycle, product release cycle, or compliance deadline.
That is exactly what the shift to on-demand, continuous penetration testing is solving.
Why Timing Has Become the Central Security Problem
Security testing has historically been planned months in advance. An engagement is scoped, scheduled, conducted, documented, and delivered on a timeline that assumes the business can wait. For a significant portion of the year, it can. For the moments that matter commercially, it usually cannot.
An enterprise customer asking for penetration test evidence during due diligence is asking about the current state of the product, not its state twelve months ago. A compliance assessor reviewing SOC 2 evidence is evaluating whether security testing happened across their observation period, not just in a two-week window at the start of the year. A board preparing for a funding round needs security documentation before the data room opens, not after the process closes.
In 2026, PTaaS obliterates the limitations of static, point-in-time pentesting with dynamic platforms that fuse human expertise and technological scale. The market has moved because the need moved. Organisations across New Zealand, Australia, Fiji, and the Pacific are no longer buying penetration testing as an annual project. They are buying it as a continuous programme that delivers expert findings when findings are needed.
What On-Demand Expert Testing Actually Delivers
The term on-demand is used loosely in security. For some providers it means faster scheduling. For others it means a different delivery model entirely. The distinction matters because the output is only as valuable as the method behind it.
Genuine on-demand expert testing means a qualified, credentialled tester begins meaningful work on a defined scope within days rather than weeks. It means findings are surfaced as they are identified rather than consolidated into a final report at the end of a fixed window. It means retesting a patched vulnerability is a scheduled activity rather than a separately negotiated engagement. And it means the evidence trail produced is continuous and current rather than a historical snapshot that ages from the moment it is delivered.
PTaaS quality depends on skilled human testers who can simulate sophisticated adversary behaviour that automated tools cannot replicate. This is the critical point that the on-demand model sometimes obscures. Speed is valuable. Expert depth is non-negotiable. The two are not in opposition, but the second cannot be sacrificed for the first. A finding produced quickly by a qualified tester who has reasoned through the application's specific logic is worth more than a finding produced quickly by any other means, because it is the qualified tester's professional accountability that makes the finding credible to an auditor, a customer, or a board. Capture The Bug's penetration testing services are built around this combination: CREST-certified expert depth delivered through a model that moves at the speed of the businesses it serves rather than the speed of a traditional consulting engagement.
The Market Has Already Made Its Decision
The scale of adoption tells the story clearly.
The global penetration testing as a service market is valued at USD 1.20 billion in 2026 and is projected to reach USD 4.88 billion by 2033, growing at a compound annual rate of 22.2 percent. That growth rate reflects a genuine shift in how organisations think about security testing, not just a change in delivery format.
For ANZ and Pacific businesses, the implications of this shift are immediate and commercial. The companies winning enterprise deals, passing compliance audits, and satisfying investor due diligence in 2026 are not the ones with the thickest annual penetration test report. They are the ones with the most current, continuous, and credible evidence of an active security programme. The evidence that satisfies these requirements is not produced by scheduling a test once a year and waiting for the report. It is produced by a programme that keeps pace with the product, responds to the moments when evidence is needed, and maintains an ongoing record of testing activity that an auditor can review across an entire observation period.
How This Model Works in Practice for ANZ Teams
For a SaaS company in Auckland or a payment platform in Sydney managing a continuous release cycle, the practical experience of on-demand expert penetration testing changes how the security programme relates to the rest of the business.
Rather than a security testing engagement being a separate, periodic event that the engineering and compliance teams have to plan around, it becomes a standing capability that activates when the product changes or when evidence is needed. A new feature shipping next month can be tested before it goes live rather than after. A compliance deadline next quarter can be met with current evidence rather than with a report from earlier in the year that covers a different version of the product.
The retesting discipline changes too. In the traditional model, verifying that a found vulnerability has been correctly patched requires either faith or a separately negotiated retest engagement. In a continuous programme, retesting is part of the service. A patched finding is verified by the same qualified tester who identified it, and that verification is documented in the same evidence trail that the original finding sits in. For the Christchurch fintech company from the opening story, this would have meant three deals with current evidence available on request rather than two delayed deals and one deal closed on a promise. The commercial value of that difference, measured in sales cycle length, enterprise deal conversion rate, and compliance documentation cost, is where most of the return on investment in continuous testing actually lives.
Your Last Pentest Is Already Out of Date
Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement.
The Right Questions Before Choosing a Provider
Not every on-demand penetration testing provider delivers the same thing. Before committing to any programme, the questions that distinguish genuine expert depth from the appearance of it are straightforward.
Are the testers CREST-certified? CREST certification is the internationally recognised benchmark for penetration testing professional standards. It is what auditors and enterprise procurement teams in New Zealand, Australia, and internationally recognise as the mark of a qualified, accountable assessment. A provider that cannot confirm CREST certification is asking a business to stake its compliance programme and its commercial relationships on credentials that are not independently verified.
Is retesting included? A provider that charges separately for retesting is structuring the engagement so that verified remediation is financially discouraged. That is not a continuous programme. It is a traditional engagement with a faster delivery wrapper.
Does the evidence trail satisfy compliance requirements? SOC 2 Type II, ISO 27001, and PCI DSS all require evidence that is current, independent, and professionally accountable. The documentation produced by the testing programme should be structured to travel directly into those compliance processes without requiring the team to reformat or supplement it. Capture The Bug's penetration testing services answer all three questions clearly: CREST-certified testers, retesting included as part of the programme, and compliance-ready documentation produced as a standard output rather than an optional extra.
The Timing Advantage That Compounds Over Time
The benefit of on-demand expert testing is not only in the individual moments when evidence is needed urgently. It compounds over time. A team that runs continuous, expert-verified testing across the full year builds an evidence trail that gets more valuable with each quarter. By the time a SOC 2 Type II observation period closes, the evidence does not need to be assembled or explained. It exists, it is current, and it is credible. By the time an enterprise prospect asks for security documentation, the answer is not "we can get that to you in six weeks." The answer is "here it is." That difference, between having the evidence and needing to produce it, is what the on-demand model ultimately delivers for businesses across New Zealand, Australia, Fiji, and the Pacific that are serious about using security as a commercial advantage rather than an annual compliance exercise.
Plan Your Annual Pentesting Strategy the Right Way
Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits.
FAQ
1. What is on-demand penetration testing?
On-demand penetration testing is a model where qualified security testers begin work on a defined scope within days rather than weeks, surface findings as they are identified rather than in a final report at engagement close, and include retesting as a standard part of the programme. It allows businesses to test when and where security evidence is needed rather than on a fixed annual schedule.
2. How does on-demand expert testing differ from traditional penetration testing?
Traditional penetration testing is a fixed-window engagement that produces a final report at completion, typically taking four to six weeks end to end. On-demand expert testing operates as a continuous programme where testing activity, findings, and retesting verification are ongoing and current. The evidence trail is built continuously rather than assembled at the end of a single engagement.
3. What is PTaaS and why is it growing so fast?
PTaaS, or Penetration Testing as a Service, is the delivery model that enables on-demand, continuous expert-led security testing through a platform rather than a traditional consulting engagement. The global PTaaS market is valued at USD 1.20 billion in 2026 and is projected to reach USD 4.88 billion by 2033, reflecting a fundamental shift in how organisations buy and use penetration testing.
4. Does on-demand testing sacrifice depth for speed?
Not when the testing is conducted by qualified, credentialled experts. CREST-certified testers apply the same adversarial reasoning and professional methodology as a traditional engagement. The difference is in delivery speed and continuity, not in the quality of the assessment. Speed without expert depth produces unverified findings; expert depth delivered quickly is what the PTaaS model is designed to achieve.
5. How does continuous expert testing support SOC 2 and ISO 27001 compliance?
SOC 2 Type II assessors evaluate evidence across a six to twelve month observation period and expect security testing activity to be distributed across that period. ISO 27001 expects a recurring testing cadence. Continuous on-demand testing produces evidence that is current and distributed rather than concentrated in a single window, which satisfies both frameworks far more effectively than an annual engagement.
6. Does Capture The Bug provide on-demand penetration testing in Fiji and the Pacific region?
Yes. Capture The Bug provides CREST-certified continuous and on-demand penetration testing across New Zealand, Australia, Fiji, and the broader Pacific, with compliance documentation suitable for SOC 2, ISO 27001, PCI DSS, and enterprise due diligence requirements.
