Category
Where Revelion fits
Revelion is not a scanner with better marketing, and it is not a consultancy with an API. It is the recurring half of penetration testing, run by an agent, and it sits between the two things you already have.
The testing stack
Frequency
Annual accredited pentest
Once or twice a year
Human depth, creative attack paths, accreditation for compliance
Revelion
As often as you deploy
Proven exploitability, chained access, evidence for every finding
Vulnerability scanning
Continuous
Known signatures and versions, flagged but unproven
Revelion replaces neither neighbour. Scanning still finds the known and keeps the inventory honest, and an accredited human engagement still carries the depth and the certificate. The middle band is the one most estates never had.
The gap
Two tools, and a gap neither one covers
Most estates already run a scanner and book an annual engagement. Between them sits the majority of the year, and the majority of the risk.
- A scanner cannot prove anything
- It matches signatures and versions and produces a queue. Whether any of it is reachable, chainable or exploitable in your environment is left for somebody to work out.
- An annual engagement describes one week
- It is deep, creative and accredited, and it is accurate on the day it ran. Everything shipped in the following fifty-one weeks is untested until the next one.
- The gap is where the estate changes
- New services, new code, new suppliers, new configuration. Exposure arrives on the deploys neither tool is looking at.
Side by side
What each layer actually produces
| Vulnerability scanning | Revelion | Annual accredited pentest | |
|---|---|---|---|
| Frequency | Continuous | As often as you deploy | Once or twice a year |
| Method | Signature and version matching | Autonomous offensive engagement | Human offensive engagement |
| Output | A queue of possible issues | Proven, reproducible access | A deep report, human-authored |
| Proves exploitability | No | Yes | Yes |
| Chains weaknesses together | No | Yes | Yes |
| Carries accreditation | No | No | Yes, CREST or CHECK |
| Cost model | Per asset, per year | Credits, priced before you run | Per engagement |
Boundaries
What Revelion does not do
Worth stating plainly, because the answer decides whether this fits your programme or not.
- It is not accredited
- Where a scheme, insurer or contract mandates a CREST or CHECK engagement, Revelion does not satisfy that requirement. Keep the accredited test and use Revelion for the rest of the year.
- It is not an asset inventory
- A scanner sweeping everything you own is still the cheapest way to know what exists and what is unpatched. Revelion tests what you point it at.
- It is not always-on
- Missions run on a schedule and on demand, as often as you deploy. That is far more often than annual, and it is not the same as continuous.
- It is not a replacement for judgement
- It reports what it proved. Deciding what that means for your business, and in what order to fix it, is still yours.
Go deeper
The detail behind each comparison
Work out what the middle band is worth against what you spend today.
Open the ROI calculator