Continuous Testing and Penetration Testing Service Provider

Thames Water is seeking a qualified Continuous Testing supplier (PTaaS) to implement and manage a comprehensive, fully governed continuous testing framework for IT security. The service will cover penetration testing, red and purple team exercises, cyber stress testing, vulnerability discovery, and remediation retesting. The preferred supplier must support a multi-phase continuous testing model (such as tag and release cycles) where red team activities transition into purple teaming upon detection, with findings shared in real-time while testing continues across phases. Active collaboration with Thames Water teams is required during all purple team activities, including control validation, detection capability assessment, and response process verification. The solution must demonstrate clear human oversight across all testing, validation, and remediation activities, with automation supporting workflows (tracking, reporting, prioritization) but not replacing core testing or assurance functions. The supplier must facilitate collaborative remediation and retesting, ensuring findings are handed over, validated, and retested with Thames Water teams, maintaining end-to-end traceability through closure. Key requirements include: availability of at least yearly penetration testing, a fully functional PTaaS service meeting applicable cadences, and a qualified, accredited, and vetted support team. The PSQ submission deadline is Tuesday, 3 November 2026, at 12:00 p.m.