Penetration Testing as a Service

Dark Wolf proposes a Penetration Testing as a Service (PTaaS) solution, combining security frameworks, such as NIST Risk Management Framework (RMF) and Payment Card Industry (PCI), with software automation and a dashboard to integrate active security control testing into the DevSecOps process. As part of Continuous ATO, when the Air Force Director of Cyberspace Innovation identifies a critical national security project that requires a faster path to approval than the traditional RMF process provides, a manual security evaluation to validate security controls can be performed. Based upon findings, the Director can approve the accreditation of the project far faster than the RMF process. However, these manual evaluations are costly, time consuming, and require several personnel per test. Air Force projects, like those of most financial institutions, perform these types of evaluations at most twice a year which leads to gaps in security. Given the sheer volume of Air Force projects which need to go through the accreditation process to receive ATO or retain their current ATO, a more cost effective and less manpower intensive solution is required. PTaaS solves these problems while also supporting ongoing accreditation of the system through integration with development pipelines, which allows for automated re-testing.