How Do I Handle Required Penetration Testing for Every New Feature?

Honestly, if your CTO is pushing for a pentest on every feature, they might not fully grasp how these tests work in a practical sense. Usually, organizations only perform pentesting when launching major updates or sensitive features. To go about this sustainably, consider defining 'high-risk features' that definitely need pentesting, while using automated tools for everything else. Also, it might be worthwhile to discuss budget concerns with your CTO since external pentesting can quickly add up.

First off, don't rely too heavily on AI like ChatGPT for decision-making—it's better to gather insights from real experts! Pen tests can vary significantly. Some are done with credentials, while others aren’t. However, having to pentest every new feature sounds overly ambitious, especially for a small team like yours. Instead, you could focus on integrating basic security testing practices in your development process. This will help catch issues early without getting stuck waiting for each feature to be tested individually.

If you're short on security expertise internally, bringing someone in-house or training a developer is a solid idea. Additionally, consider using automated security tools like SAST or DAST for continuous security testing. It’s crucial to document your security practices and have regular reviews, which can often catch issues before they even make it to a pentest.

Remember, the requirement for a pentest doesn’t absolve the team of maintaining security best practices. Focus on training and implementing crucial security checks as standard practice. If your CTO insists on full pentests for every feature, bring evidence to the table showing that this won't work well—many companies just do an annual pentest or audit instead.

Great questions! A pen test typically looks for vulnerabilities based on what access they have, whether through staging environments or with credentials. It's definitely unrealistic to request pentesting for every feature, especially when you’re a small team under tight deadlines. You could suggest conducting pentests less frequently—for example, on new integrations or significant changes—and implementing automated scanning tools to help bridge the gap.