Per-release penetration testing after meaningful releases
Pentesting after each release: scope only the delta, retest earlier findings and get a report with evidence for that release. No fixed cadence is promised.
Short answer
Per-release testing means a scoped pentest after a meaningful release. We test the changed features and the paths they touch, and we retest findings from earlier work. You agree the delta in writing first. We do not promise a fixed cadence, always-on testing or a turnaround time.
Per-release testing is a pentest of what changed. After a meaningful release, you send us the delta. We test the new and changed paths, retest earlier findings and send you a report for that release.
When is a release worth testing?#
A release is worth a test when it changes who can do what, or how data moves. Small copy and style changes do not need one. These do:
- a new role or permission
- a new API endpoint or version
- a change to login, sessions, password reset or MFA
- a payment, billing or entitlement change
- a new file upload, import or export
- a new integration or webhook
- a change to tenant boundaries
You and Excession Labs decide the trigger during scoping. We set no fixed cadence.
What is a scope delta?#
A scope delta is the written list of what changed since the last test. It names the new or different features, endpoints, roles and environments, and the test focuses there.
| Part of the delta | What you provide | What we test |
|---|---|---|
| New endpoints | Route list or API spec change | Authorization, input handling, error behavior |
| Changed roles | Role matrix and a test account per role | Differential checks across roles |
| Changed auth flow | Description of the new flow | Session handling, reset and token paths |
| Unchanged areas | A statement that they are unchanged | A light check only if the scope asks for it |
| Earlier findings | The previous report | Retest of fixed items |
If the delta is wrong, the test can miss a change. The report states what the scope covered, so gaps show.
How does the retest work?#
We replay the original steps for each finding you say is fixed. The controls that held run again, so we can see that a fix did not break a working protection. Incursion supports retesting a finding.
The report for the release shows each earlier finding as retested and fixed, retested and still open, or not retested. We save the new request and response with timestamps as evidence for each retest.
What do you receive for each release?#
The same structure as any other engagement, sized to the delta: scope, method, safety constraints, findings with evidence, controls that held, remediation plan and limitations. Formats are HTML, PDF and Markdown, plus proof-of-concept scripts. Excession Labs checks the evidence for each finding and writes the report. How it works covers the full sequence.
What do we not promise?#
We do not promise testing on every deploy, always-on coverage, a start date, a turnaround time or a retest window. Each release test is a scoped job with a written scope, owner authorization and a report. The safety page lists the limits.
How do you set it up?#
- Run a first full or pilot test, so you have a baseline report.
- After a meaningful release, send the change list and any new test accounts.
- We agree the delta in writing and confirm authorization.
- The test runs under the usual tool rules.
- You receive the report and fix.
- You ask for a retest of the fixes.
Pentesting in CI/CD covers test placement near your pipeline. Testing signed-in flows with AI agents covers role and session setup. Pricing lists what drives the quote.
Run it on your application
Start with a scoped pilot. Incursion tests, a person checks each finding, and you get a report with evidence.
Questions
Do you test every commit?
No. This service targets meaningful releases, such as a new role, a new API area, a payment change or an auth change. You and Excession Labs agree which releases are worth a test.
Is a retest included?
We can retest fixed findings. Whether a retest is part of a quote is agreed during scoping. Ask for it in the scope.
Can this run in my CI pipeline?
The service is not a CI gate. A person agrees each scope, and Excession Labs checks the evidence. The CI/CD guide shows how teams place pentests near their release flow.
How do I know what changed?
You send release notes, a list of changed endpoints or a diff summary. We write the delta into the scope. If the change list is incomplete, the report says so.
Run it on your application
Start with a scoped pilot. Incursion tests, a person checks each finding, and you get a report with evidence.