Penetration Testing Services for SaaS — External, Web App, Mobile, API and Cloud

It depends on your attack surface. External network pentest (PTES methodology, NIST SP 800-115) covers internet-exposed infrastructure — DNS, mail, perimeter services, exposed admin interfaces. Web app pentest covers your application logic and is scoped against OWASP ASVS (Application Security Verification Standard) L1 for opportunistic threats, L2 for most SaaS applications handling sensitive data, L3 for high-assurance (healthcare, fintech, defence). Mobile pentest follows OWASP MASVS (Mobile ASVS) covering platform (iOS/Android) controls, network, cryptography, auth and code quality. API pentest follows the OWASP API Security Top 10 2023 (BOLA, broken auth, BOPLA, unrestricted resource consumption, etc.) and tests authn/authz at the request level. Cloud config audit reviews AWS/GCP/Azure against CIS Benchmarks plus provider-specific Well-Architected Framework security pillar. Most SaaS need web app + API + cloud config annually; mobile if you ship a mobile app.

Our lead testers hold a combination of OSCP (Offensive Security Certified Professional — practical 24-hour exam), OSCE/OSEP (more advanced exploitation), CREST CRT/CCT (UK industry-recognised, accepted by HMG and Bank of England CBEST), and where relevant CISSP for the senior advisor role. Why it matters: an OSCP-holder has demonstrably exploited multi-host environments under time pressure; an automated scanner has not. Enterprise procurement, Bank of England CBEST, EU TIBER-EU, and most cyber-insurance underwriters now ask for named credentialed testers on the engagement, not just a firm's marketing claim of 'certified professionals'.

Every finding is scored on CVSS v4.0 (the current FIRST-published vector that includes Threat and Environmental metrics, plus the Safety/Automated/Recovery extensions). We also assign a contextual business risk rating because CVSS alone misses tenant isolation and data-classification context. The report contains: an executive summary readable by the board, a methodology section citing PTES phases and the ASVS/MASVS/API Top 10 chapters tested, a findings section with reproduction steps, CVSS vector, business impact, and prioritised remediation, an attack narrative reconstructing the path an attacker would take, and an appendix of testing evidence. We also deliver a remediation tracker as JIRA-importable CSV.

Yes — every engagement includes one free retest within 90 days of the report. We re-execute the proof-of-concept for every High and Critical finding, verify the fix, and reissue a clean retest letter you can hand to enterprise procurement or an auditor. Out-of-scope retests (more than 90 days, or expanded scope) are quoted at 30% of the original engagement. For continuous assurance, a quarterly retainer keeps testing on a rolling cadence with continuous retest between engagements.

SOC 2 expects a regular pentest as evidence for CC4.1 monitoring and CC7.1 vulnerability identification; our reports are accepted by every major audit firm. PCI DSS v4.0.1 Req 11.4.3 requires annual external/internal penetration testing plus after any significant change; Req 11.4.5 requires segmentation testing (annual merchants, every 6 months service providers). HIPAA does not name 'penetration test' explicitly but §164.308(a)(8) requires periodic technical evaluation — pentests are the de-facto evidence. EU AI Act Article 15 requires accuracy, robustness and cybersecurity testing; DORA (Regulation (EU) 2022/2554) imposes Threat-Led Penetration Testing (TLPT) on significant financial entities from January 2025. We map every finding to the relevant control so the report does double duty in audits.

Fixed-scope, all-in USD pricing across four tiers. A basic vulnerability scan runs from $700 (2–3 days): automated scanning with manual triage and a prioritised fix list. An app or site pentest is from $1,400 (1–2 weeks): a single web application or site, OWASP ASVS L2 by default with authenticated multi-role and business-logic testing. An external infrastructure pentest is from $2,300 (1–2 weeks): the internet-facing perimeter per PTES + NIST SP 800-115. An internal network or comprehensive engagement is from $4,100 (2–4 weeks): multi-surface web/API/mobile/cloud with tenant-isolation and lateral-movement testing. What moves the number is scope size, surface count and required assurance level. You see the line-item budget at the end of scoping and sign off before any testing begins — no recruitment markup, no tool surcharges, and a free retest within 90 days is included on every tier.

Every pentest report includes: an executive summary readable by non-technical leadership, a methodology section citing PTES phases and the specific OWASP/NIST standards tested, a findings section with reproduction steps, CVSS v4.0 vector, business impact, and prioritised remediation guidance, an attack narrative that reconstructs the path a real attacker would take, and a JIRA-importable CSV remediation tracker. For High and Critical findings, we include a working proof-of-concept that your engineering team can reproduce in a safe environment to validate the fix.

We use CVSS v4.0, the current FIRST-published scoring standard that includes Base, Threat, and Environmental metrics plus Safety, Automatable, and Recovery extensions. Every finding receives a CVSS v4.0 vector string alongside a contextual business risk rating, because CVSS alone can misrepresent severity when tenant isolation or data classification context matters. For example, a medium CVSS score on a BOLA/IDOR vulnerability affecting multi-tenant SaaS may carry Critical business risk if it exposes all customer data.

Yes — every engagement includes one free retest within 90 days of the final report. We re-execute the proof-of-concept for every High and Critical finding after your team has applied fixes, verify the remediation is effective, and reissue a clean retest letter that enterprise procurement or an auditor can accept as evidence of resolution. Out-of-scope retests (beyond 90 days or expanded scope) are quoted at 30% of the original engagement fee.

The answer depends on your compliance obligations and change velocity. PCI DSS Req 11.4.3 requires annual external and internal penetration testing, plus after any significant infrastructure or application change. SOC 2 auditors expect at least annual testing for CC4.1/CC7.1 evidence. HIPAA §164.308(a)(8) requires periodic technical evaluations with no defined interval — annual is the de-facto standard. Beyond compliance, fast-moving SaaS teams typically benefit from quarterly or semi-annual testing to catch vulnerabilities introduced by new features before they reach enterprise customers.

Automated scanners (ZAP, Nuclei, Burp Scanner) excel at coverage — they can enumerate thousands of parameters, test known vulnerability patterns at scale, and surface configuration issues quickly. But they systematically miss business logic flaws, authentication state confusion, BOLA/IDOR at an application level, and chained vulnerabilities that require contextual reasoning across multiple requests. In our engagements, automated tools run in support of manual testing to maximize coverage, but the findings that matter come from hypothesis-driven manual testing.

A vulnerability scan enumerates known CVEs and misconfigurations against a signature database — fast, broad, but shallow. It reports potential vulnerabilities, many of which are false positives or unexploitable in your specific configuration. A penetration test takes exploitable findings further: the tester chains them together, escalates privileges, demonstrates lateral movement, and produces a breach scenario that shows your CISO and board what an attacker could actually achieve. Scans are inputs to our triage process; manual exploitation is the output that matters for compliance evidence.