Continuous Security Testing


Continuous Security Testing for agile Development and DevOps

Continuous Security Testing ensures, that systems and applications are analyzed for vulnerabilities in a continuous cycle. The selected methodology allows close integration into the agile development process and thus enables a high and continuous test coverage.

  • Integrate manual security reviews into your development process.
  • Identify vulnerabilities and find solutions.
  • Continuously increase the security level of your critical applications.

When is Continuous Security Testing useful?

Continuous Security Testing is useful for all applications that are developed in short iteration cycles. Modern development methods often do not allow the necessary time windows for manual security tests. By integrating the security tests into the development process, vulnerabilities in the source code can be detected and remedied early on. In addition, the continuous inspection in production allows to continuously increase the security level as well as to prove a high degree of test coverage. The close integration drastically shortens the communication paths between tester and developer, thus increasing efficiency.


What alternatives to Continuous Security Testing are available?

The strengths of Continuous Security Testing can be leveraged especially for agile development methods, especially DevOps. For applications that are not subject to short release cycles and have sufficient time slots for in-depth security testing, SEC Consult offers classic security reviews such as penetration testing and security source code reviews.

How much does Continuous Security Testing cost?

The efforts for Continuous Security Testing scale with several factors. Essential criteria are the desired test depth depending on the criticality of the application, as well as the scope and complexity of the application. The length of the release cycles and thus the frequency of the checks play only a minor role, since a higher frequency leads to lower costs per test run. A monthly review will be about 4 times larger per test run compared to a weekly review, as the changes in the application will be correspondingly larger. The initial set-up times for the integration of the Security Test Team into the development process are negligible over the duration of Continuous Security Testing and the associated costs are already in the single-digit percentage range of the total effort after the first year.


What types of Continuous Security Testing are available?

SEC Consult distinguishes between development security monitoring (DevSECMon) and application security monitoring (AppSECMon). DevSECMon continuously checks the source code during development. With AppSECMon, regular checks in the production environment ensure that the application is never untested for an extended period of time.