Intigriti's PTaaS - Frequently Asked Questions (FAQ)

Intigriti's PTaaS is a modern security testing solution that combines the best aspects of traditional penetration testing with the agility and impact-driven approach of bug bounty programs. It offers structured, focused, and transparent penetration test engagements designed to deliver meaningful security insights and reward real impact.

Traditional pentests often involve long lead times, limited visibility until the final report, and a rigid, one-size-fits-all approach. Intigriti's PTaaS offers faster results (typically within 2-3 weeks), real-time collaboration and visibility into findings, flexible coverage for various asset types, and a "Hybrid Pay-for-Impact" model that incentivizes deeper testing for critical vulnerabilities.

While PTaaS incorporates the pay-for-impact incentive common in bug bounty programs, it provides a more structured and focused test setup. It involves committed researchers for a defined period, industry-standard pentest methodologies and formal deliverables like a Letter of Attestation or full penetration test reports depending on selected PTaaS type.

PTaaS is designed for:

Intigriti offers three PTaaS types:

PTaaS supports a broad range of assets, including web applications, APIs, AI models, mobile applications (iOS & Android) and network infrastructure.

The best type depends on your specific requirements:

Yes, particularly the Certified Pentest type. This type is designed for compliance-grade testing by certified experts and can help meet requirements for standards like SOC-2, DORA, and ISO 27001, etc. Intigriti has also achieved CREST accreditation, further supporting the quality of Intigriti’s PTaaS service.

This model combines a base bounty (daily rate) to keep researchers focused on the defined scope with a bounty pool (additional rewards) for meaningful and impactful results. This approach encourages researchers to conduct in-depth testing and identify critical vulnerabilities. Both, the base bounty and the bounty pool can be adjusted based on asset complexity to attract the right skills.

Engagements can often start in days, not weeks. Intigriti's PTaaS aims to deliver meaningful results typically within 2-3 weeks, offering a faster turnaround than many traditional pentests.

Once the scope of the pentest has been reviewed and the goals and objectives have been defined, the pentest will be launched for applications. Intigriti’s vetted researchers for pentests will be able to apply. Planned enhancements aim to improve researcher selection visibility and specialization matching further.

Reporting varies by type:

You get full visibility throughout the assessment via the Intigriti platform. Findings are delivered in real time. You can interact directly with the researcher via a dedicated communication channel or through the platform to ask questions or provide context.

CREST is a recognized standard in the cybersecurity industry. For Intigriti, achieving CREST accreditation for its PTaaS offering signifies a commitment to quality, recognized methodologies, and the ability to meet the stringent requirements of regulated industries and enterprise clients.

Yes, Intigriti has achieved CREST accreditation. This is a key part of our strategy to provide trusted, high-quality penetration testing services.

Intigriti's CREST accreditation means that our PTaaS offering, particularly the Certified Pentest type, aligns with CREST's recognized standards for delivering penetration testing services. It underscores our capability to provide:

Compliance-ready testing suitable for enterprises and regulated sectors.

Services delivered with a high degree of professionalism and technical capability.

Increased trust and assurance for customers who require adherence to internationally recognized security testing standards.

Here is a breakdown of the proposed pricing for each version:

While both a Letter of Attestation (LoA) and a penetration test report are outcomes of a security assessment, they serve different purposes and are intended for different audiences—with varying levels of detail.
​
A Letter of Attestation (LoA) is a short, formal document that confirms a penetration test was carried out. It is typically shared with third parties such as customers, partners, or auditors who require proof of testing without access to sensitive vulnerability information. It focuses on transparency and trust without disclosing technical details.
Intigrit's LoA includes:

A pentest report, on the other hand, is a detailed technical document aimed at internal teams such as security, engineering, or compliance. It provides a full breakdown of the testing process and results, supporting remediation and long-term security improvements.
Intigriti's full pentest report includes:
​

In short:
The LoA acts as a lightweight proof of testing for external assurance, while the pentest report is a complete, actionable guide to addressing discovered vulnerabilities—making it the more valuable and comprehensive deliverable for internal use.

Existing customers can use the new pentest request wizard in the Intigriti platform to submit their scope, objectives, and requirements directly. New customers or those with complex needs can contact the Intigriti sales or customer success team for assistance.

The Certified Pentest type specifically includes a "Certified testing team". Researchers may hold certifications such as CREST’s CCT INF / CCT APP or CREST equivalent certifications such as the OSCP, OSWE, SANS GPEN, etc. While other types leverage our wide pool of vetted, proven researchers, the Certified type is explicitly designed to work with certified professionals only to meet higher compliance and assurance needs.

​