CASP and penetration testing are often mixed — that wastes budget. We separate them: CASP is passive outside-in profiling with authorisation; a pentest is active, approved scope with RoE and PoCs. So you know what is worth doing first.
A mid-market firm plans “a pentest” but has 12 domains and unclear shadow IT. We recommend CASP Full first on prioritised domains (outside-in, DNS-TXT), a report with top risks, and a later narrower pentest on 2 critical apps. Result: pentest budget drops, findings map to goals — without selling CASP as a pentest substitute. Figures and names are anonymised; the flow matches typical engagements.
Method separation protects budget and signal quality. We document limits in writing — freelance, with public CASP price orientation, without critical guarantees. That is intentional and part of the positioning.
This page’s job: Owns the CASP vs pentest method and budget cut only. Not scan comparison, not pure authorisation how-to.
Quick orientation — final in the scope meeting:
→ CASP first.
→ Authorised pentest with RoE.
→ Staged: outside-in, then active test.
→ No CASP; no serious start.
→ Not our CASP product; decline or separate honestly.
→ Decline.
A pentest without a clear outside-in picture often tests the wrong surface or inflates scope. A scan report without analyst prioritisation creates alert fatigue. Both feel like security — neither delivers a defensible decision on what to fix first.
IT and business leaders in DACH SMEs and B2B who steer security budget and refuse to buy “just scan something”. Ideal before the first expensive active test or after unclear scanner reports.
Many vendors mix outside-in and active testing in one pitch. That creates false expectations and unclear reports. We separate methods and say when each makes sense — and when it does not.
CASP reports and pentest findings are not sold as one “everything tested” sentence.
Often outside-in first, active test after — not both by default, only when it serves the goal.
DNS-TXT for CASP, written approval and RoE for pentest — no “quick test”.
We maximise clarity, not the sales story “we always find X”.
Typical boundaries in this decision space:
Honest recommendation: CASP only, pentest only, or staged
CASP passive with DNS-TXT; pentest active only with RoE
Separate deliverables and acceptance
Active exploits inside CASP scope
Unauthorised tests “because the client is in a hurry”
Finding-count or ranking guarantees
If you want methods cut honestly: scope meeting. If you want a mixed all-inclusive security package without limits, we are not the fit.
Method boundaries first — no mixed CASP/pentest theatre.
Decision confidence: outside-in picture and/or active proof in approved scope — not mixed methods.
DNS-TXT authorisation, clear CASP vs pentest limits, signed report or RoE and PoCs.
CASP often orients in 10–21 days; pentest follows once the test space is sharp.
Domain approval and contacts — no months of tool onboarding for CASP.
Visibility and priority first — then targeted active tests, not blind flight.
CASP report and pentest findings stay methodically and contractually separate.
No fear marketing, no “we are everything” fluff.
Passive outside-in profiling, signed report, prioritisation.
Active testing only after approval, RoE, and defined scope.
Which offer first — in advisory and content.
CASP Lite € 7,500 · Full € 19,900 — scope stays transparent.
Decision, compliance evidence, or pre-pentest?
Authorisation, passive profiling, report.
What is urgent, what can wait, what belongs in active testing?
Only with RoE and approved targets — separate scope.
No. CASP is passive outside-in. A pentest validates actively in approved scope.
No. Many start with CASP. Pentest follows when goals and value are clear.
Public: Lite from € 7,500, Full € 19,900. Details and scope in a conversation.
Contact with goal and domain. DNS-TXT before CASP start; pentest with written approval.
Yes, when scope and goals are already sharp. CASP helps when outside-in is unclear — not dogma.
CASP Lite/Full in defined day windows (see pricing/business plan); pentest depends on scope and RoE.
The most expensive pentest is the one with unclear scope. Before active testing, outside-in clarity pays: which domains and services are visible? What is no-go? What should the test prove? CASP and clean RoE prep reduce blind flight and renegotiation.
Open topic →Automated vulnerability scans produce lists. CASP produces a prioritised outside-in picture with analyst accountability, authorisation, and a signed report. Mixing them buys either too little depth — or too much noise without a decision. For DACH companies the point is clarity before the next budget step, not more PDF volume.
Open topic →Without verifiable domain authorisation, SHELL-AFFECT does not start CASP. DNS-TXT verification ensures only owned or written-approved domains are viewed outside-in — for trust, scope, and clear responsibility before any passive security analysis begins in a DACH context.
Open topic →Tell us whether you need outside-in clarity, an active test, or both — we separate scopes.