Where does your penetration testing data live? Three deployment models, explained_

A penetration test asks a lot of trust. To do the job properly, a testing provider may need test credentials, network diagrams, architecture documents and, by the end, a detailed list of your weaknesses.

So “where does all of that go?” is a fair question. For many organisations it’s the first one.

Block8.ai offers three deployment models. Here’s what each one means for your data, in plain English.

1. SaaS (the default)

Most customers use our multi-tenant SaaS platform. You can be set up the same day. What happens to your data:

•  On our Australian platform, data is hosted in Australia (Sydney) by default.

•  AI inference runs in Australia.

•  Test credentials are encrypted in a secrets vault and never re-displayed. Only credential metadata appears in the interface.

•  Each customer’s data is isolated at the data layer, not just in the application, so even a compromised application server can’t bypass it.

•  Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

•  Reports are downloaded through short-lived signed links.

For customers who need contractual certainty, hard residency contracts can be enforced at the cloud-account level.

Best for: most organisations and standard engagements.

2. On-premise Virtual Appliance (hybrid)

The Virtual Appliance is a hybrid option. It runs on your own virtualisation infrastructure so we can test systems that are only reachable from inside your network. It works alongside our SaaS platform rather than replacing it, and it adds a layer of segmentation. Setup usually takes one to two working days.

•  The appliance is hardened, with full-disk encryption.

•  It connects through an identity-based tunnel, with no inbound firewall holes required on your side.

•  Findings and their metadata sync back to the Block8.ai platform, and AI inference still runs in the cloud. On our Australian platform, that’s Amazon Bedrock in Australia.

•  You can reuse the appliance for later engagements, and its disk stays encrypted while it’s switched off.

Best for: testing internal-only systems from inside your network.

One honest trade-off: running an appliance means your team takes on some operational responsibility, such as hosting the VM and applying new images as we release them.

3. Customer-managed cloud

If you have existing cloud agreements, or residency rules that our default region can’t satisfy, the platform can be deployed into your own cloud account. It’s scoped per engagement, so the details are agreed with you up front.

One difference to plan for: when the platform runs in your own cloud account, Human in the Loop review is done by your own analysts, not by Block8.ai’s.

Best for: organisations with established cloud governance and their own security analysts that want testing to run inside it.

How to choose

Start with these questions:

•  Are the systems you need tested reachable only from inside your network?

•  Do you have contractual or regulatory residency requirements that our default hosting can’t meet?

•  Do you have cloud agreements and governance that you want testing to run under?

•  If testing runs in your own cloud, do you have analysts who can take on Human in the Loop review?

If you answered “no” to the first three, our SaaS platform is probably right. A “yes” to the first points to the Virtual Appliance. A “yes” to the second or third points to customer-managed cloud, and that’s where the fourth question matters.

What stays the same

Whichever model you choose, you get the same methodology, the same evidence-backed findings and the same reports. What changes is where the testing runs, where the data lives and, in a customer-managed cloud, who does the human review. You’ll know exactly which model you’ve chosen.

What to do next