Documentation / Pentesting as Code (PAC)

Pentesting as Code (PAC)

Pentesting as Code (PAC)

Pentesting as Code (PAC) is Prancer's approach to turning real-world attacker behavior into versioned, repeatable code that runs inside your CI/CD pipeline — so security validation happens continuously, not just once a year.

Why it matters: traditional manual pentests are slow, hard to repeat, and almost always run too late. PAC shifts pentesting *left* — it runs at build time, on every change, with zero false-positive noise.

What PAC does for you

• Codifies attacks. Real attack patterns (and zero-day signatures) are stored as code you can version, review, and reuse.
• Runs autonomously. PAC scans your cloud and application endpoints automatically — authenticated or unauthenticated, from trusted or untrusted networks.
• Correlates with cloud context. Built on Prancer's CSPM engine, PAC ties every finding back to the actual cloud configuration that caused it, dramatically reducing false positives.
• Integrates with CI/CD. Drop PAC into your pipeline and fail builds when new high-risk findings appear.
• Delivers proof in minutes. Actionable pentest reports are generated as soon as the run finishes — not weeks later.

How it fits into your SDLC

1. Discover. PAC's CSPM engine auto-learns your cloud's application and service endpoints. 2. Codify. Attacks (including custom and CVE-based) are defined as PAC configuration files. 3. Execute. PAC runs the attacks from inside or outside your network, with full authentication support. 4. Report. Findings flow into the Prancer portal, your ticketing system, and your SIEM. 5. Validate. Every fix is re-tested automatically on the next pipeline run.

Before you start

You'll need:

• A Prancer account (register here) and a user access token.
• Read access to the cloud environment you want to scan (AWS, Azure, or GCP).
• *(Optional)* A CI/CD system (GitHub Actions, Azure DevOps, GitLab, Jenkins) if you plan to automate runs.

Next steps

• Quick Start → — fastest way to get a first scan running.
• PAC for AWS · PAC for Azure · PAC for GCP
• PAC CLI — run PAC from your local machine or pipeline.
• Pentest Findings — interpret and triage results.

Image gap: add a one-page architecture diagram showing PAC sitting between cloud discovery → attack codification → CI/CD → findings, to visually anchor this overview.