CBTS Launches AI-Enabled Penetration Testing as a Service

New service combines autonomous penetration testing with security expertise to help organizations validate exploitable risk, uncover real attack paths, and prioritize remediation as their environments evolve.

News highlights 

• Moves beyond point-in-time annual testing with continuous security validation that keeps pace with changing cloud, SaaS, AI, identity, and third-party environments.
• Validates which vulnerabilities are actually exploitable in a client's environment and demonstrates how attackers could chain weaknesses into real attack paths, revealing the business risk individual findings alone may not expose.
• CBTS penetration testing and ethical hacking professionals review every assessment, providing expert context, remediation guidance, and customer-specific recommendations.
• Customized reporting helps security teams prioritize remediation based on validated exploitability and track progress over time.

CINCINNATI – Aug. 11, 2026 – CBTS, a leading North American technology services company, today announced the launch of Penetration Testing as a Service (PTaaS), leveraging industry-leading autonomous penetration testing capabilities. The new service helps organizations move beyond point-in-time annual testing with autonomous penetration testing and CBTS security expertise to validate exploitable risk, reveal real attack paths, and prioritize remediation as environments evolve.

Annual testing can’t keep up with continuous change

Cloud environments, SaaS applications, connected systems, third-party relationships and AI systems are expanding enterprise attack surfaces faster than traditional testing cycles can track, and the industry's own breach data backs that up, as vulnerability exploitation now outpaces stolen credentials as attackers' top way in, with AI narrowing the gap between disclosure and exploitation from months to hours.

"Organizations are moving beyond point-in-time assessments to continuous security validation, and partners like CBTS are helping make that transition practical," said Tim Mackie, Global Vice President of Worldwide Channels, Horizon3.ai. "By combining the autonomous penetration testing capabilities of NodeZero with CBTS's security expertise, organizations can continuously validate exploitable risk, prioritize remediation based on evidence, and strengthen their security posture as their environments evolve."

AI generated findings need human review to ensure accuracy

CBTS built PTaaS on NodeZero to autonomously perform penetration tests across live production environments without disrupting operations. CBTS security experts review the results of each assessment, providing customer-specific context and remediation guidance. Together, they extend penetration testing from a once-a-year checkpoint into an ongoing practice, giving organizations continuous evidence of which risks are actually exploitable as new vulnerabilities, configurations, and identity exposures emerge.

“Environments don’t stand still, so threat identification can’t either,” said Ryan Hamrick, Director, Security Practice, CBTS. “Traditional penetration testing gives organizations a valuable snapshot, but that snapshot can age quickly as new vulnerabilities, configurations, identities and systems are introduced. CBTS PTaaS helps clients continuously verify which risks are actually exploitable in their own environment, understand how attackers could chain them together, and prioritize remediation with confidence.”

How it works

Powered by NodeZero, CBTS PTaaS runs recurring penetration tests across a client's environment to validate exploitable risk and demonstrate how individual weaknesses can chain together to form real attack paths. CBTS penetration testing and ethical hacking professionals review each assessment to provide expert context, remediation guidance, and customer-specific recommendations. Every finding comes with 100% proof of exploitability.

The service provides clients with:

• Validated exploitability based on testing within the client's environment, helping security teams focus on the risks attackers can actually exploit.
• Attack path analysis showing how multiple weaknesses could be chained together to compromise critical systems.
• Expert review from CBTS penetration testing and ethical hacking professionals, providing customer-specific context, remediation guidance, and recommendations for reducing validated risk.
• Customized reporting that helps security teams prioritize remediation based on validated exploitability and track progress over time.
• Flexible testing frequency that allows organizations to choose a daily, weekly, monthly, or quarterly cadence based on their risk profile, business needs, and security maturity.

As organizations adopt Continuous Threat Exposure Management (CTEM) programs, security teams need ways to continuously identify, validate, and prioritize the exposures most likely to create business risk. Verizon's 2026 Data Breach Investigations Report found that a vulnerability's likelihood of being exploited again drops by roughly half just 30 days after its last observed exploitation, a finding that reinforces why continuous validation and prioritization, not one-time patching, is what reduces risk.

CBTS PTaaS helps organizations put that approach into practice by assessing vulnerabilities alongside configuration issues, identity exposures, and other weaknesses across systems, devices, applications, and networks. By validating which risks are actually exploitable and demonstrating how they can be chained together into real attack paths, the service gives security teams a clearer path from exposure discovery to remediation, helping reduce noise, focus resources, and strengthen their security posture over time.

This is a critical capability when adversarial frontier AI models are dramatically increasing the volume of newly disclosed vulnerabilities. Contextual prioritization helps security teams focus on the exposures that matter most and respond with confidence. To learn more about CBTS Penetration Testing as a Service, visit our blog. For more on the CBTS cybersecurity portfolio, see our new website.