INSPECTOR What a penetration test is
A penetration test (pentest) is a one-time exercise in which a certified specialist tries to break into a specific application, network or system, with permission and within a defined scope, and delivers a report of what they achieved and how. It is deep, it is manual and it is a snapshot: it describes how that system stood on those days. A manual pentest of a single application typically costs between $3,000 and $18,000 USD depending on scope, and it is normally repeated once a year or after a major change.
A corporate customer, a regulator or an auditor asks for it; an application that handles money or sensitive data needs it before launch; and it is done well by someone with offensive experience. We do not do it with AI and we do not sell "autonomous attackers": we quote it separately with a partner, per tester-day.
What continuous monitoring is
Monitoring answers a different question. Not "how hard is it to break into this app today?" but "what does my company have exposed right now, what changed since last week, and what new threat came out for the things I run?". AI agents re-check the inventory of everything exposed to the internet every week, review every change that lands in the code, follow published vulnerabilities and leaked credentials, and alert within 24 hours when something critical appears. A person reads the results and explains them every month.
It is wide, it is continuous and it is a film rather than a snapshot. It will not find what a good pentester finds in complex business logic, but it will find the port someone opened on Tuesday, the key left in the repository and the critical vulnerability published yesterday for your version of WordPress, Nginx or your Node library.
Side by side
| Penetration test | Continuous monitoring | |
|---|---|---|
| Frequency | Once; repeated yearly or after a major change | Every day; report every month |
| Scope | One defined application or system, in depth | Everything exposed to the internet, code, servers, cloud and new threats |
| Who does it | A certified specialist, manually | AI agents; a person reads and explains the report |
| What it finds best | Logic flaws, exploit chains, anything that needs human creativity | Changes, new exposures, secrets in code, published vulnerabilities, leaked credentials |
| Risk to production | Controlled, but there are active tests against the system | None: read-only, no attacks |
| Typical cost | $3,000–$18,000 USD per application; with our partner $1,500–$2,500 USD per tester-day | Vigía $900 USD a month; Vigía Plus $1,800 USD a month; Onboarding $2,000 USD one time |
| Deliverable | Detailed technical report with proofs of concept | Management page + technical report + monthly call; alert within 24 h on anything critical |
When each one makes sense
A pentest makes sense when you are launching or redesigning an application that handles money or sensitive data, when a customer, regulator or auditor requires it in writing, or when you already have monitoring and want a deep test of one specific system.
Monitoring makes sense when you have no security team and nobody reviews what you expose; when your infrastructure changes often (deployments, new servers, new vendors); when what worries you is ransomware, invoice fraud and leaked credentials more than a sophisticated flaw; and when you want a monthly document that shows someone is watching.
Both make sense for a company that already depends on its own software: monitoring every day and one pentest a year on the most critical application. Because monitoring already clears the obvious, the pentester spends their days on what truly needs a human, and the retest is shorter.
What does not make sense is confusing them: an automated assessment nobody reads is not a pentest, and a pentest from ten months ago does not tell you what you have exposed today.