Most NZ organisations running penetration testing today are running it as an annual project. A scoping call, a testing window, a report that arrives weeks later. The engagement ends when the PDF is delivered.
Traditional penetration testing has a structural problem: it is a project, and your software is a stream. For NZ companies that ship on a weekly or monthly release cycle, the annual test captures a point in time that is stale within days of the next deploy. For NZ companies with a stable product and a single annual compliance requirement, it is exactly the right format.
The decision between PTaaS and a traditional test is not a question of quality. It is a question of whether the delivery model matches how your organisation actually builds.
What Actually Changes Between the Two Models
A traditional pentest is a fixed-scope, time-boxed engagement that ends with a PDF report. PTaaS extends this with a portal for live finding delivery, continuous communication, on-demand retests, and remediation tracking that persists between assessments.
The global PTaaS market is valued at USD 1.20 billion in 2026 and is projected to reach USD 4.88 billion by 2033, reflecting a fundamental shift in how organisations buy and use penetration testing. In NZ, that shift is slower than the global average. Most NZ businesses are still on the annual model. A smaller number have moved to PTaaS subscriptions, and two CREST-certified PTaaS platforms operate in the NZ market.
The practical differences for NZ buyers:
Live Finding Delivery vs Stale Final Reports
Findings in a traditional engagement arrive in a final report after testing ends. Findings in a PTaaS engagement appear live on a dashboard as they are discovered. An engineering team working against a sprint cycle can start remediation on finding one while the tester is still discovering findings two and three.
Integrated Retesting Workflow
Retesting in a traditional engagement is typically a new contract or a paid add-on. In a PTaaS platform, retesting is part of the workflow. This distinction matters most for NZ SaaS teams that are fixing findings quickly and need confirmed closure for compliance purposes within the audit period, not weeks after it ends.
When a Traditional Test Is the Right Choice for NZ Buyers
Traditional testing often fits unusual, sensitive, on-site, or one-time scopes. PTaaS often fits recurring testing across changing assets. For NZ organisations, a traditional one-off engagement is likely the better choice when:
1. A Single Compliance Deadline with No Planned Follow-Up
A NZ company preparing for a first ISO 27001 certification needs a dated, independent penetration test report. A PTaaS subscription that produces dashboard findings but no formal dated report may not satisfy the certification body's evidence requirement. Confirm the provider produces a compliance-grade report before assuming a PTaaS plan qualifies.
2. Specialist or On-Site Access Requirements
OT/ICS environments, physical security assessments, and hardware testing require in-person engagement and bespoke rules of engagement. A PTaaS platform built for SaaS web application testing is not the right tool for an industrial control system or a NZ energy infrastructure assessment.
3. Stable Products on an Annual Release Cadence
A NZ organisation with a mature, stable product and fewer than three significant changes per year does not have the change velocity that makes PTaaS continuous coverage valuable. An annual CREST test from a specialist is proportionate to that risk profile.
For how the testing frequency decision maps to your specific ANZ compliance framework, the guide to penetration testing frequency and how often to test in 2026 covers the cadence model for each framework including NZ Privacy Act, SOC 2, and ISO 27001.
Continuous Security That Matches Your Sprint Velocity
CREST-certified testing from Hamilton, NZ. 48-hour kickoff, direct Slack access to your lead tester, free retesting for 90 days, and real-time dashboard reporting.
When PTaaS Is the Right Choice for NZ Buyers
PTaaS delivers the most value for NZ organisations that ship frequently and need compliance evidence that reflects the current state of their system, not a point-in-time snapshot from last November.
For SOC 2 Type II audits, a PTaaS model providing continuous testing throughout the audit period is stronger evidence than a single point-in-time test. The continuous evidence trail generated through PTaaS is often more compelling to auditors than a single annual report.
For NZ SaaS companies, the four contexts where PTaaS outperforms the traditional model:
1. Shipping to Production More Than Once per Quarter
Each significant release is a potential new attack surface. Testing only once per year means every release between tests is untested in production.
2. API-First Products with Multiple User Roles
Multi-role API testing requires retesting each time a new role, endpoint, or integration is added. Buying that as a separate engagement each time is expensive and slow.
3. Preparing for SOC 2 Type II Audits
The audit period runs for six to twelve months. A single annual test at month one does not demonstrate ongoing attention to security across the period.
4. Demonstrating Continuous Posture to Enterprise Buyers
The guide to what happens after a penetration test covers how the retest and confirmed closure evidence that PTaaS produces continuously is the specific artefact enterprise buyers and compliance frameworks check.
Capture The Bug is CREST-certified and operates from Hamilton, NZ, with a 48-hour kickoff, direct Slack access to your assigned tester, free retests for 90 days, and a live findings dashboard. NZD $2,000 for a web application assessment, NZD $5,000 for a compliance-aligned penetration test. Explore our transparent pricing and subscription options.
Frequently Asked Questions
What is the difference between PTaaS and traditional penetration testing?
Traditional penetration testing is a fixed-scope, time-boxed engagement that ends with a final report. PTaaS (Penetration Testing as a Service) is an ongoing delivery model with a live findings platform, continuous communication, on-demand retests, and remediation tracking that persists between assessments. The testing methodology in both models can be identical in quality: what changes is when findings arrive, how retesting works, and how compliance evidence is produced over time.
Does PTaaS satisfy NZ Privacy Act and SOC 2 compliance requirements?
Yes, when the provider produces a compliance-grade report alongside the live platform findings. A PTaaS subscription that only delivers dashboard output without a formal dated report may not satisfy certification body requirements. For SOC 2 Type II audits, PTaaS continuous testing throughout the audit period is often stronger evidence than a single annual test because it demonstrates ongoing security attention rather than a point-in-time snapshot. For NZ Privacy Act IPP 5 compliance, a PTaaS engagement that produces a dated report with remediation and retest records satisfies the reasonable steps standard.
When should a NZ business choose a traditional penetration test over PTaaS?
A traditional test is the better choice when the engagement is for a single compliance deadline with no planned follow-up, when the environment requires on-site specialist access (OT/ICS, physical security, hardware), when the product is stable with fewer than three significant changes per year, or when the organisation needs a single independent dated report for a transaction or certification. Traditional testing and PTaaS are not rivals: many NZ organisations use a formal annual test to satisfy compliance and PTaaS for ongoing coverage between formal assessment cycles.
How much does PTaaS cost vs a traditional penetration test in NZ?
In NZ, traditional penetration testing starts at approximately NZD $5,000 for a standard web application and API engagement. Enterprise-scale or specialist engagements range from NZD $10,000 to $30,000 or more. PTaaS subscriptions spread testing costs across the year. Capture The Bug offers NZD $2,000 for a web application vulnerability assessment and NZD $5,000 for a compliance-aligned penetration test. PTaaS subscription pricing includes recurring tests, unlimited retesting within the subscription window, and a live dashboard.
What NZ companies offer CREST-certified PTaaS?
Two CREST-certified PTaaS platforms operate in the NZ market: Capture The Bug (Hamilton, NZ, CREST-certified, CREST AI Charter founding signatory) and Blacklock (NZ-headquartered, CREST-certified, approved on the NZ Government Marketplace). Both deliver continuous security testing through a platform model. Traditional CREST-accredited penetration testing without a PTaaS platform is also available from ZX Security (now Bastion Security), Amaru, and Pulse Security in NZ.
