Practical Validation - Controlled Testing
Periodic Penetration Test
Cocoon tests your physical security not just once, but in a fixed cycle, ensuring your resilience grows alongside evolving threats.
- Recurring tests within a fixed rhythm, tailored to your risk profile
- Trend-based insights via a dashboard instead of a single snapshot
- Fixed cycle with clear agreements, comparable to an ongoing program
What is a periodic penetration test?
A periodic penetration test is a recurring physical penetration test that Cocoon performs within a fixed cycle—for example, annually or semi-annually—rather than as a one-off test. This provides visibility into whether your security continues to function as threats, employees, and processes change.
This service is relevant for organizations that have been tested before and want to structurally monitor their resilience, rather than re-testing by chance after an incident. A periodic penetration test is often implemented after an initial physical penetration test, during growth or at new locations, or as a permanent component of a security awareness program.
Similar to what is known in the digital world as Pentest as a Service (PTaaS), where software is tested continuously rather than once, Cocoon builds that same continuity for the physical world: not a snapshot, but a recurring cycle performed by the same team.
How does a periodic penetration test work at Cocoon?
With many alternatives, periodic testing is limited to repeating the exact same test annually, without taking into account what has changed in the meantime. Cocoon builds each cycle on the previous one: new threats, new employees, and changed processes are included so that every test remains relevant.
Together with you, we determine a fixed cycle that fits your risk profile, often annually or semi-annually. Prior to each round, we update the scope and the Rules of Engagement to account for new situations such as a relocation, reorganization, or previous findings. This makes it an ongoing program with fixed agreements, similar to a subscription model, rather than a series of separate quotes.
Each round is followed by a debriefing and a report, just like a regular physical penetration test. The difference lies in the follow-up: findings are compared with previous cycles, providing you with trend-based insight into whether your resilience is actually increasing, rather than a separate annual snapshot.
Furthermore, each cycle is linked to a security maturity level. Cocoon advises on the concrete steps needed to grow to the next level. The results are recorded in a visual dashboard, allowing you to easily compare them with previous tests and other locations, both in the Netherlands and abroad.
Why choose Cocoon
For Cocoon, a periodic penetration test is the most direct translation of our principle that security is never finished. We do not assess security measures we have provided ourselves, which ensures our findings remain objective.
Not a vendor of individual tests, but your long-term partner in security awareness.
Because we continue to manage the same cycle, we build knowledge of your organization that makes each subsequent test sharper.
- Independent validation, separate from provided security systems
- Trend-based insight instead of isolated snapshots
- Fixed cycle with a dedicated team, ensuring knowledge of your organization is retained
Please note: under NIS2 and the General Security Requirements for Central Government Commissions (ABRO), actual testing of security measures is required.
Performing a periodic penetration test helps meet the requirements of NIS 2 and the ABRO.
Cocoon works for renowned (publicly) listed companies in profit and non-profit environments; references are available upon request.
Frequently asked questions
What is the cost of a periodic penetration test?
The costs of a periodic penetration test are budgeted per cycle and depend on the frequency, scope, and number of locations. Following the intake, you will receive a proposal for the fixed cycle, including an estimate per round.
How often is a periodic penetration test performed?
Is a periodic penetration test legal?
Yes. Each round of a periodic penetration test is conducted exclusively with the client’s written consent, within predefined Rules of Engagement. These frameworks are reconfirmed prior to every cycle.
What is the Difference Between a Periodic Penetration Test and a Retest?
A retest is a one-time verification of previously identified vulnerabilities from a single specific test, to confirm whether remediation measures are effective. A periodic penetration test is broader: it is a recurring cycle of comprehensive tests, regardless of previous findings, focused on structural validation rather than verifying a single prior report.
What is the difference between a periodic penetration test and Pentest as a Service (PTaaS)?
Pentest as a Service (PTaaS) is the most well-known form of continuous testing, but for software and networks: a platform with dashboards and fixed integrations with DevSecOps teams. A periodic penetration test from Cocoon follows the same principle, but for the physical world. Not a platform, but a fixed cycle of physical tests by the same team, at your own locations. For those thinking in those terms: this is the physical counterpart to PTaaS.
Will the same team continue to perform the cycle?
Whenever possible, we work with a dedicated team for each organization to ensure that accumulated knowledge of your locations and previous findings is retained. This makes each subsequent round more efficient and targeted.
What happens if we want to adjust the scope in the interim?
That is possible. Prior to each round, we update the scope together—for example, following a relocation, reorganization, or new location—to ensure the test remains relevant to your current situation.
How does periodic testing help my organization grow in security maturity?
Cocoon links periodic tests to the Cocoon Physical Security Mark (CPSM), a certification mark under development with five ascending levels: Bronze, Silver, Gold, Platinum, and Diamond, each with demonstrable, SMART-formulated requirements. Each round is compared with the previous measurement: have critical findings been resolved, is the testers’ success rate decreasing, are employees reacting more alertly? In this way, growth becomes demonstrable, based on measured results rather than intuition. Furthermore, it prevents misguided investments: periodic testing shows what has an immediate effect, what can wait, and what proves to be redundant, ensuring that every security budget is deployed purposefully.