Agile Penetration Testing Program

Integrated into your software development lifecycle (SDLC), Kroll’s agile penetration testing program is designed to help teams address security risks in real time and on budget.

Talk to an Expert

Explore Cyber Risk

Cyber Insights

The Monitor Newsletter

24x7 Cyber Incident Hotlines

What is Agile Penetration Testing?

Agile penetration “pen” testing is a continuous security assessment approach that allows companies to speed up secure software delivery to their customers.

Traditionally, penetration tests occur on an infrequent, “point in time” basis within the scope of a product release cycle or based on compliance mandates. This approach may fit if you still use the waterfall method, but it falls short if you use agile or other continuous development methodologies.

Unlike traditional pen testing(which tends to slow down product teams), when properly integrated within the SDLC, agile penetration testing can keep pace with your release schedule. The result: saving your business the time and expense of having to remediate long-standing problems that could have been identified much earlier in the process.

Agile pen testing is a programmatic way to unearth and remediate potential risks in an application within the existing timelines and schedules of product releases. Just as features are added or updated constantly during sprints, continuous penetration testing can make sure that the security of those new features are being tested just as frequently.

Get Started on Your Agile Pen Testing Program with the eBook. Download now.

Merging Product, Development and Security For Greater Efficiency

Many product teams have adopted agile software development methodologies but have not integrated pen testing into the agile process. For most, penetration testing remains a standalone process performed alongside other annual assessments. Our agile pen testing programs integrate into your product team’s software development lifecycle to reduce the timespan between code changes and security assessments, so code is not released to production with unknown risks.

The program is designed based on strong fundamentals in program planning and onboarding with teams to ensure minimal disruption to current engineering processes. Kroll’s dedicated program team aims to build institutional knowledge by providing continuity, expertise and support for making technical decisions with security in mind.

The Agile Assessment Lifecycle

A view into a standard deployment of the agile penetration testing program:

The Agile Assessment Lifecycle

Managed Agile Pen Testing Program Overview

In contrast to the usual method of conducting a security assessment by means of a pen test near the end of the release cycle, Kroll’s developer-centric security consultants engage with product engineering and project management teams to identify and remediate security vulnerabilities throughout the entire product release cycle.

This agile approach helps ensure that every product release, be it a minor bug fix or a major feature release, has been vetted from a security perspective. The solution model covers the following:

Enhancing the development sprint plans to include the appropriate level of security assessment required
Strategizing “abuse cases” for every release through a rapid threat modeling exercise ahead of development

Validating countermeasures to the said abuse cases, along with exploratory threat scenarios through an agile pen testing exercise post development
Logging of any potential vulnerabilities directly on development platforms, such as JIRA, Azure DevOps, etc., for remediation
Validating the applied fix (remediation) by conducting an optional retesting exercise
Analyzing vulnerability patterns, scoring, time to fix and other critical statistics and communicating program improvement opportunities in sprint recaps

Managed Agile Pen Testing Program

Onboarding and Program Development	Management	Tracking and Reporting
Key activities include: Contextual Knowledge of App(s) Security Requirements Strategy Agile Framework & Methodology Release Cadence/Cycles Roadmap Planning	Throughout the program, each test is carefully considered: Track & Scope Pen Test Cycles Frequency Priority Coverage Assign resources Consistent monitoring	Efforts can tracked via a variety of reports and adjusted for key stakeholders: Vulnerability Tracking and Prioritization Remediation Testing and Tracking Budget and Effort Tracking KPIs and Metrics Trend Analysis

Key Benefits – The End Results

The efficiency and flexibility of agile, with a more secure product:

Cyber Insurance Preferred Partner

Kroll has a dedicated team for insurance and legal channels, with extensive relationships with 50+ cyber insurance brokers and carriers worldwide and exclusive benefits to insureds.

Endlessly Adaptable

Development and security teams seamlessly communicate to cater testing to new features and priorities.

Fewer Vulnerabilities

Over time, the backlog of software vulnerabilities decreases.

Native Security

Ongoing feedback and collaboration helps developers implement better secure development practices in new code.

Why Kroll?

Our team conducts more than 53,000 hours of cyber security assessments every year and carries well over 100 security certifications encompassing offensive security, cloud, penetration testing, mobile, and web testing.
Senior team members have each spent decades working in cybersecurity and our award-winning penetration testers are certified to some of the highest global industry standards, including CHECK, CREST (CCT/CRT) and SANS (GIAC).

Kroll handles over 3,000 incident response cases worldwide every year, enabling us to leverage the latest frontline threat intelligence and adversary mindset in every engagement.
Our testers have diverse backgrounds in information technology, application development and cyber investigations. This experience enables them to anticipate evolving and emerging cyber threats for our clients across industries and jurisdictions.

Agile Pen Testing as Part of a Cyber Risk Retainer

Kroll’s ultra-flexible Cyber Risk Retainer can package your agile pen testing needs along with a variety of services like risk assessments, tabletops and red team exercises and more. With the retainer, clients also gain prioritized access to Kroll’s elite digital forensics and incident response team in the event of an incident.

Comprehensive Related Services

All these services can also be available as part of the Kroll Cyber Risk retainer:

Network Penetration Testing – External and Internal
Application Penetration Testing – External and Internal
Web Application Penetration Testing
IoT Device Penetration Testing
Dark Web Risk Exposure
Social Engineering Exercises
Red/Blue Team Exercises
Cyber Due Diligence Assessments

Connect With Us

Rob Deane

Associate Managing Director

Cyber Risk

New York

+1 4156935381 Rob Deane

Rahul Raghavan

Senior Vice President

Cyber Risk

Toronto

Rahul Raghavan

Stay Ahead with Kroll

Penetration Testing Services

Validate your cyber defenses against real-world threats. Kroll’s world-class penetration testing services bring together front-line threat intelligence, thousands of hours of cyber security assessments completed each year and a team of certified cyber experts — the foundation for our sophisticated and scalable approach.

Penetration Testing Services

API Penetration Testing Services

Kroll’s certified pen testers find vulnerabilities in your APIs that scanners simply can’t identify. Protect your business and keep sensitive data secure by leveraging our knowledge and experience in testing modern API infrastructures.

API Penetration Testing Services

Cloud Penetration Testing Services

Kroll’s team of certified cloud pen testers uncover vulnerabilities in your cloud environment and apps before they can be compromised by threat actors.

Cloud Penetration Testing Services

Web Application Penetration Testing Services

Assess the design, configuration and implementation of your web apps for critical vulnerabilities. Kroll’s scalable pen testing services consider the business case and logic of your apps, providing more coverage and an optimized program based on risk.

Web Application Penetration Testing Services

Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Cyber Risk Retainer

Explore Insights

The Economics of Secure Software Development

Cyber Governance and Risk