Question 1

What triggers a continuous scan — commit, deploy, or schedule?

Accepted Answer

Any of them. Webhooks let you fire scans on commit, on pull request, or on deploy, and you can also schedule runs. You pick the events per repository so scanning matches how your team ships.

Question 2

Which CI/CD systems can this plug into?

Accepted Answer

GitHub, GitLab and Jenkins are supported through the integrations hub, with webhooks and a CLI entry point for pipelines. Findings can be pushed onward to alerting channels.

Question 3

Can a scan block or fail a build or release?

Accepted Answer

Yes. You set severity thresholds, and a run that breaches them can fail the pipeline step so risky changes do not ship. Teams often start in report-only mode and tighten the gate once the baseline is clean.

Question 4

What does continuous scanning cost compared to a one-time pentest?

Accepted Answer

Continuous scanning runs on the VAPT Scanner, which is priced per scan — ₹3,999 per scan, billed from your scan history — so choose your triggers with that in mind; see VAPT Scanner pricing. For comparison, one-time engagements in the Indian market typically cost ₹1.5–4 lakh (USD 2,000–5,000) for a focused web application test and ₹5–15 lakh (USD 6,000–18,000) for combined network + web VAPT on a mid-size environment; Infronest application assessments start at ₹36,750 per application per year, or ₹42,000 one-time.

Question 5

How long do setup and each scan run take?

Accepted Answer

Connecting a webhook and setting thresholds is a same-day task. Per-run time scales with the profile — quick profiles are built for in-pipeline feedback, full profiles run longer and suit nightly or deploy triggers. A formal point-in-time engagement, by contrast, typically takes one to three weeks industry-wide.

Question 6

Is continuous scanning the same as a continuous manual pentest?

Accepted Answer

No, and we are clear about that. This is automated scanning wired into your pipeline for fast, repeatable feedback. Human penetration testing is a separate engagement — the two complement each other rather than replace one another.

Question 7

How is this different from a one-time engagement?

Accepted Answer

A one-time engagement is a scoped, point-in-time assessment with a dated report. Continuous security runs automatically on every change and tracks trend over time, so new regressions are caught between formal assessments.

Continuous security scanning on every commit and deploy

How is this different from a one-time engagement?

Already live in the product

Included in the Infronest workspace

What you get

What teams can do here

How it works

Connect your Git provider

Set severity thresholds

Scan on every change

Gate, alert and trend

A worked example

Frequently asked questions

Catch the regression before it merges

Continuous security scanning on every commit and deploy

How is this different from a one-time engagement?

Already live in the product

Included in the Infronest workspace

What you get

What teams can do here

How it works

Connect your Git provider

Set severity thresholds

Scan on every change

Gate, alert and trend

A worked example

Frequently asked questions

All VAPT services

Web application vulnerability assessment & penetration testing

Mobile application security testing (APK / IPA)

API penetration testing for REST, GraphQL & microservices

Network penetration testing, internal and external

Cloud penetration testing for AWS, Azure and GCP

Remediation support and retests that prove fixes held

Explore connected offerings

Web application vulnerability assessment & penetration testing

Git governance, access, repository, and security views

API penetration testing for REST, GraphQL & microservices

Catch the regression before it merges