Pay Per Vulnerability vs Traditional Penetration Testing: Which Is Better for Your Business?
Pay per vulnerability or traditional pentesting?
Traditional penetration tests charge you for time, whether or not they find anything that matters. Pay per vulnerability (PPV) under Penetration Testing as a Service (PTaaS) charges you only for real, proven weaknesses.
In this guide
Pay per vulnerability
Choose pay per vulnerability when you want to pay for results, keep your budget under control and test often. Choose a traditional fixed-scope pentest only when a one-time, point-in-time report is all you need.
- With traditional pentesting, you pay for the tester’s time. The bill is the same whether they find nothing or find a lot.
- With pay per vulnerability, you pay for each verified finding, priced by how serious it is.
- With PPV PTaaS, every finding is proven, scored with CVSS and checked for false positives before it reaches an invoice.
What is traditional penetration testing?
A traditional penetration test is a project. A security firm agrees a scope, sends testers for a fixed number of days, and hands you a report at the end. You pay a fixed fee for that effort.
Where it works well
- A clear, one-time deliverable for an audit or customer request
- A fixed price you can approve in advance
- Deep manual work in a short, planned window
Where it falls short
- You pay for time, not for results, so a quiet test costs as much as a busy one
- It is a snapshot. New code and new risks appear the day after the report
- Reports can include false positives and noise your team must sort out
- Scheduling is slow, and re-tests can cost extra
- It is hard to compare vendors, because everyone sells hours differently
What is pay per vulnerability (PPV) penetration testing under PTaaS?
Pay per vulnerability is an outcome-based model. PTaaS gives you ongoing access to security testing and a live dashboard. With PPV, you are billed per verified vulnerability, at a rate that matches its severity: Low, Medium, High or Critical.
In plain words: if we find nothing serious, you pay very little. If we find something serious, you pay more, and you can act on it straight away.
Where PPV works well
- You pay for proven results, not hours
- Spending follows real risk, so budgets are easier to explain
- Testing can run as often as you release, not once a year
- Every finding has proof, so developers can fix it faster
- You can set a spending cap to avoid surprise bills
Key You Should Know
- The total depends on what is found, so you need a cap or a clear rate card to plan the budget
- The model needs a trusted verification process, or counts can be inflated
- Some auditors still expect a formal point-in-time report, which a good PPV provider can also supply
- Very large or highly complex scopes may suit a fixed-price option better
Pay per vulnerability vs traditional pentesting
| Area | Traditional pentesting | Pay per vulnerability (PTaaS) |
|---|---|---|
| What you pay for | Tester time and days | Verified, proven vulnerabilities |
| If little is found | You still pay the full fee | You pay very little |
| Testing frequency | Usually once or twice a year | Continuous or on every major release |
| Budget predictability | Fixed up front | Controlled by rate card and spending cap |
| False positives | Often included in the report | Excluded, never billed |
| Re-testing | May cost extra | Included to confirm your fix |
| Visibility | A report at the end | A live dashboard as findings are verified |
| Vendor incentive | Hours sold | Real, useful findings |
Why companies should choose pay per vulnerability?
1. You pay for value, not time
Every charge is linked to a real finding with proof. Nothing is billed for effort that found no problem.
2. Less budget risk
Set an annual or monthly spending cap. You will be informed at 80% if it goes beyond capping target.
3. Security that keeps pace
PPV testing can follow your releases, so risks are found while the code is still fresh.
4. Less noise for your team
False positives and duplicates are removed before you see them. Your developers only get issues that are real.
5. Fair, clear pricing
Everyone understands Low, Medium, High and Critical. Leaders can explain the bill in one minute to their senior.
How pay per vulnerability works with CVSS scoring
CVSS, the Common Vulnerability Scoring System, is the industry standard for rating how serious a weakness is. It gives every issue a score from 0 to 10. We use it so that pricing is fair and easy to check.
Step 1: Validate
Our security engineers confirm the issue is real, can be repeated and can be acted on, with proof of exploit.
Step 2: Score
We measure the base technical severity with the latest CVSS standard.
Step 3: Add business context
We look at how easy it is to exploit, who could reach it and what it would mean for your data and operations, then confirm the final rating.
| Severity | CVSS score range | What it usually means |
|---|---|---|
| Critical | 9.0 to 10.0 | Attackers could take over systems or steal sensitive data. Fix immediately. |
| High | 7.0 to 8.9 | Serious weakness that is likely to be exploited. Fix as a priority. |
| Medium | 4.0 to 6.9 | Real risk that usually needs another condition to be exploited. Plan the fix. |
| Low | 0.1 to 3.9 | Limited impact on its own. Fix as part of routine work. |
Why this matters: you can always see why a finding was rated the way it was, and what you are being billed for. Pay per vulnerability only works when the count is trustworthy.
Why false positives are excluded from pay per vulnerability billing
A false positive is an alert that looks like a weakness but is not one. Automated scanners create many of them. They waste developer time and, in a careless pay-per-finding model, they could inflate your bill. That is why a trustworthy PPV provider must remove them first.
You are never billed for
- False positives
- Duplicate findings
- Non-actionable noise
- Issues we cannot reproduce
- Re-tests that confirm your fix
How access0day keeps findings honest
- We use several tools, then a human engineer verifies every result
- Each finding includes proof, so you can see it for yourself
- You can dispute any finding before it is billed
- Chained issues are counted once, at their true severity
Which pay per vulnerability model should you choose?
There is no single right answer. Pick the model that matches how your team ships and how your finance team plans.
| Model | How it works | Best for |
|---|---|---|
| Pay per vulnerability (on-demand) | No subscription. A small engagement to start, then you pay per verified finding by severity. | Teams that want to try PPV, or test a few assets once or twice |
| Subscription plus pay per vulnerability | An annual plan with continuous testing, lower rates per finding and Low findings included. | Teams that release often and want ongoing coverage with a spending cap |
| Fixed price per service | One agreed fee for a defined service such as web, mobile, cloud or AI testing. | Teams that need a set budget or a report by a set date |
Not sure? Tell us how often you release, what you need to protect and which deadlines you have. We will recommend one option and explain why.
Black box vs gray box vs white box testing: what is the difference?
The three “boxes” describe how much we know about your system before we start. The more we know, the deeper we can go in the same time. Under access0day PPV, the rate per severity is the same for all three, so you can choose the approach that fits your risk and not the cheapest label.
Black box: the outside attacker
We start with no inside information, only the public view of your system, just as an attacker would.
Gray box: the logged-in user
We get limited access such as test user accounts and basic documents. This reflects a customer, partner or insider who has some access.
White box: the full view
We get deep access such as source code, architecture and configuration. This finds hidden flaws that outside testing can miss.
| Area | Black box | Gray box | White box |
|---|---|---|---|
| What we know | Almost nothing | Some access and context | Almost everything |
| Simulates | An external attacker | A user, partner or insider with limited access | A full audit with developer-level insight |
| Depth of findings | Surface and exposed weaknesses | Logic, access control and data exposure | Deep code and design flaws |
| Effort before testing | Low | Medium | High |
| Good for | Internet-facing systems and first checks | Most web, mobile and API applications | Critical systems and high-assurance needs |
Most teams get the best value from gray box. Add black box for your outside view and white box for your most critical systems.
How access0day makes pay per vulnerability PTaaS work for you
We built access0day so that leaders can buy security testing the way they buy any other outcome: clearly, fairly and with control.
Clear scoping
We agree assets, rules of engagement and the testing approach with you before anything starts.
Multiple tools plus human experts
We combine several testing tools with experienced engineers, so coverage is wide and findings are proven.
Verified, CVSS-scored findings
Every finding is validated, scored and rated for your business context before it is billed.
Spending caps
Set a limit that matches your budget. Findings above it are still reported, so you never lose visibility.
Live dashboard and clear reports
See findings as they are verified, with proof and simple fix guidance for your developers.
Support for audits and leadership
Reports your team can use for customer reviews and compliance work, and summaries leaders can read in minutes.
How to get a pay per vulnerability PTaaS quote
Click Request a Quote and share these details:
- The websites, applications, APIs, mobile apps or cloud accounts you want tested
- Your preferred model: pay per vulnerability only, subscription plus pay per vulnerability, or fixed price
- Your preferred approach: black box, gray box or white box
- Any release schedule, audit or compliance deadline
We reply with a clear quote and a short call to confirm scope.
Pay per vulnerability pentesting FAQs
What is pay per vulnerability penetration testing?
Pay per vulnerability (PPV) is a model where you pay for each verified vulnerability found in your systems, at a rate based on its severity, instead of paying for tester time. Every charge is backed by proof.
Is pay per vulnerability better than traditional pentesting?
For most teams that release often, yes. You pay for results, spending follows real risk, and testing can run continuously. A traditional fixed-scope test can still suit a one-time need, such as a single audit.
What is PTaaS?
PTaaS stands for Penetration Testing as a Service. It gives you on-demand security testing with a live dashboard, instead of a one-off project with a report at the end.
How does CVSS decide the price of a vulnerability?
CVSS scores each verified finding from 0 to 10. Scores map to Low, Medium, High and Critical, and each severity has its own rate. We then adjust the final rating for exploitability and your business context.
Are false positives charged?
No. False positives, duplicates and non-actionable noise are removed before billing. You are billed only for verified, exploitable vulnerabilities.
Can PPV costs get out of control?
No. You can set an annual cap and a lower monthly cap. Findings above the cap are still reported in full, so you keep full visibility.
What is the difference between black box, gray box and white box testing?
Black box starts with no inside knowledge, like an outside attacker. Gray box uses limited access such as test accounts. White box uses deep access such as source code and architecture. Deeper access lets testers find more in the same time.
Which testing approach should I choose?
Most teams start with gray box for web, mobile and API applications. Add black box for your outside view and white box for your most critical systems.
Do I need to change my code or applications to be tested?
No. Your team should not change the in-scope code or applications during testing and should not run other scanning tools or vendors at the same time, so results stay accurate. Take backups in advance.
Can PPV reports be used for audits and compliance?
Yes. Reports include evidence, severity ratings and fix guidance that teams can use for customer reviews and audits such as SOC 2, ISO 27001 and HIPAA. Always confirm exact requirements with your auditor.
How do I get a quote?
Click Request a Quote and send us your scope, preferred model, testing approach and deadlines. We reply with a clear quote and a short scoping call.
Ready to pay only for the vulnerabilities that matter?
Tell us what you want to protect. We will recommend the right model, approach and spending cap, and send you a clear quote.
