Article contents
A SaaS startup needs an independent penetration test as soon as its first enterprise customer asks for a security testing report or sends a security questionnaire, and the right provider tests your web app and API (the interface programs use to exchange data) by hand, with a focus on data isolation between customers, then gives you a report and a pentest letter once fixes are in. SOC 2 and ISO 27001 show how a company manages security overall, so at the start a recent pentest with a retest, an honestly completed questionnaire and a certification plan with dates are usually enough.
Below, in plain words: what SOC 2 and ISO 27001 mean, what a typical questionnaire asks, what to show in reply and how to check that one customer can never see another customer's data. How the testing of a web app and API works is covered separately in website and API security testing.
In short
- A penetration test means a manual check of your product from an attacker's point of view: a specialist looks for ways to reach other people's data or bypass access rights.
- SOC 2 and ISO 27001 do not replace a pentest. They are about company processes, while a pentest shows whether your product is actually protected.
- The key thing for SaaS: one customer must never see another customer's data. This isolation is tested first.
- You do not send the full pentest report to customers. A pentest letter and the status of fixes are usually enough.
- An honest "partly, planned for March" in a questionnaire beats a "yes" that falls apart in an audit.
When a SaaS startup needs a pentest
The trigger is usually external: someone important to the business asks for proof that the product was tested independently. Typical moments:
- your first enterprise customer, bank or public body sends a security questionnaire;
- you are entering the EU or US market and a partner asks for an independent testing report;
- you are preparing for SOC 2 or ISO 27001 and the auditor will ask how you find vulnerabilities;
- a major release: a new API, new roles, SSO (sign in with a corporate account), integrations with other systems;
- an investor asks about product security before a funding round.
If none of these apply and the product still changes every week, start with something simpler: an external review of what is visible from the internet. Plan the full pentest before your first big deal, so the report is fresh exactly when someone asks for it.
SOC 2 and ISO 27001 in plain words
SOC 2 means an independent auditor's report on how a company controls the security of its service. It is prepared by a licensed US auditor (a CPA) against the AICPA criteria, set by the American association of accountants: security, availability, processing integrity, confidentiality and privacy. [1] [2] A Type 1 report describes how controls are designed at a given date, while a Type 2 report shows how they actually worked over a period, usually several months.
ISO/IEC 27001 means the international standard for an information security management system: how a company assesses risks, assigns owners and keeps improving its protection. The current edition, ISO/IEC 27001:2022, was published in October 2022. [3] A certification body issues the certificate after an audit.
In practice, US customers more often ask for SOC 2 and European customers for ISO 27001. Both describe processes and do not answer whether your particular API can be broken. That is why even certified companies order pentests regularly, and auditors for both standards expect to see that you test the product and fix what is found.
What a security questionnaire asks and what to show
A security questionnaire means a list of questions a large customer uses to vet a vendor before signing. It usually has a few dozen questions about access, encryption, backups, event logs, incident response, subcontractors and security testing. Here are the most common ones and what to show in reply.
| What the customer asks | What to show |
|---|---|
| Have you had an independent pentest in the last 12 months? | A pentest letter: who tested, when, what was in scope, status of findings |
| Are critical and high findings fixed? | The retest result or a list of fixes with dates |
| How do you separate different customers' data? | A description of isolation and the result of cross customer access tests in the pentest |
| Do you have SOC 2 or ISO 27001? | The report or certificate, or an honest plan with dates and what is already done |
| How are admin logins protected? | MFA (a second factor at login) for all admins, SSO, a login log |
| Is data encrypted? | Encryption in transit and at rest, who manages the keys |
| Who on your team can see our data? | A list of roles, least privilege, an access log for customer data |
| What happens in an incident? | A response plan, a contact, a deadline for notifying the customer |
Do not answer "yes" where the truth is "partly". Customers check answers during audits or before renewing a contract, and a false answer does more damage than an honest plan.
The pentest letter: what it is and why you need it
A full pentest report contains the steps to reproduce every vulnerability, so you do not send it to every customer. Instead, the provider prepares a pentest letter (an attestation letter): a short page you can safely send along with the questionnaire.
What the letter should include:
- Who and when. The provider's name and the testing dates.
- Scope. Which application, API, environment and roles were tested.
- Method. Manual testing and the guidance it followed, for example NIST SP 800-115 or OWASP. [6]
- Result. The number of findings by severity and their status after the retest.
- Contact. A signature and a way to confirm the letter is genuine.
An honest letter never says "no vulnerabilities". It says what exactly was tested and that what was found has been fixed.
Tenant isolation: the key test for SaaS
Most SaaS products serve many customers from one system, and their data sits side by side. The most expensive mistake here is simple: a user of customer A changes a number in a request and sees an invoice, a file or the user list of customer B. OWASP, an open community for application security, ranks the missing check of access rights to an individual object first among API risks. [4] Its guide to securing such systems advises never trusting the customer identifier from the request and checking that the user really belongs to that organisation. [5]
What the pentester checks:
- requests for invoices, files, reports and users with another customer's identifiers;
- invitations and roles: can you add yourself to another organisation or raise your own rights;
- exports, search, reports and webhooks (automatic messages to other systems): do other customers' records leak into them;
- file storage and cache: are other customers' files served via a direct link;
- the support admin panel: who on your team sees customer data and whether that is logged.
This test needs at least two test customers with several roles each. Without them, isolation cannot be properly tested.
Who to hire
Look for a provider who:
- tests web apps and APIs by hand, not just by running a scanner;
- puts tenant isolation and product logic in the scope as separate items;
- gives a report for developers and a separate pentest letter for customers;
- includes a retest, so the letter says "fixed", not "found";
- starts active work only after written permission and an agreed scope.
A startup in Europe does not have to hire a provider in the same country. Experience with SaaS products, the language of the report and workable hours for calls matter more. The questions to ask any company are collected in how to choose a penetration testing company.
Checklist before a customer questionnaire
Download the preparation checklist (PDF)PDF · A4
FAQ
Can I pass a security questionnaire without SOC 2?
Often yes, especially with your first customers. Show a recent pentest with a retest, a pentest letter, basic policies and a certification plan with dates. Large banks and corporations may require a certificate no matter what, so find out before signing.
What comes first: a pentest, SOC 2 or ISO 27001?
For most startups the pentest comes first: it is faster, cheaper and covers the most common questionnaire question. Plan SOC 2 or ISO 27001 when key customers explicitly require them, because preparation takes months.
Can I give a customer the full pentest report?
Better not, because it contains the steps to reproduce vulnerabilities. Give them the pentest letter and show the full report only if needed and under an NDA (a confidentiality agreement).
How often does a SaaS product need a pentest?
Usually once a year and after major changes: new roles, APIs, SSO, an infrastructure move. Customers most often ask about the last 12 months.
How long does a pentest of a SaaS product take?
It depends on the scope: the number of roles, the size of the API, the integrations. The timeline is fixed before the start, after a conversation about the product.
References
- AICPA: System and Organization Controls (SOC suite of services) aicpa-cima.com
- AICPA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022) aicpa-cima.com
- IEC Webstore: ISO/IEC 27001:2022 webstore.iec.ch
- OWASP API Security Top 10 2023: API1 Broken Object Level Authorization api-security.owasp.org
- OWASP Cheat Sheet Series: Multi-Tenant Security cheatsheetseries.owasp.org
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment csrc.nist.gov
