Building a continuous pentest pipeline that doesn’t lie

An engineering walkthrough of the OSCI continuous-pentest pipeline: what we run, how we triage findings, and how we keep false-positive rates under 8%.

OSCI Editorial

Collaboratively written by mentors and contributors.

Continuous pentest is easy to launch and hard to keep honest. After two years iterating on ours, here is the architecture we landed on, the trade-offs we considered, and the failure modes we instrument for.

We cover scanner orchestration (a thin wrapper over nuclei + zap + custom checks), the triage queue, finding deduplication, and the SLA we keep with engineering on remediation time.