Penetration Testing & Security Audits for SaaS — External, Web App, Mobile, API and Cloud

It depends on your attack surface. External network pentest (PTES methodology, NIST SP 800-115) covers internet-exposed infrastructure — DNS, mail, perimeter services, exposed admin interfaces. Web app pentest covers your application logic and is scoped against OWASP ASVS (Application Security Verification Standard) L1 for opportunistic threats, L2 for most SaaS applications handling sensitive data, L3 for high-assurance (healthcare, fintech, defence). Mobile pentest follows OWASP MASVS (Mobile ASVS) covering platform (iOS/Android) controls, network, cryptography, auth and code quality. API pentest follows the OWASP API Security Top 10 2023 (BOLA, broken auth, BOPLA, unrestricted resource consumption, etc.) and tests authn/authz at the request level. Cloud config audit reviews AWS/GCP/Azure against CIS Benchmarks plus provider-specific Well-Architected Framework security pillar. Most SaaS need web app + API + cloud config annually; mobile if you ship a mobile app.

Our lead testers hold a combination of OSCP (Offensive Security Certified Professional — practical 24-hour exam), OSCE/OSEP (more advanced exploitation), CREST CRT/CCT (UK industry-recognised, accepted by HMG and Bank of England CBEST), and where relevant CISSP for the senior advisor role. Why it matters: an OSCP-holder has demonstrably exploited multi-host environments under time pressure; an automated scanner has not. Enterprise procurement, Bank of England CBEST, EU TIBER-EU, and most cyber-insurance underwriters now ask for named credentialed testers on the engagement, not just a firm's marketing claim of 'certified professionals'.

Every finding is scored on CVSS v4.0 (the current FIRST-published vector that includes Threat and Environmental metrics, plus the Safety/Automated/Recovery extensions). We also assign a contextual business risk rating because CVSS alone misses tenant isolation and data-classification context. The report contains: an executive summary readable by the board, a methodology section citing PTES phases and the ASVS/MASVS/API Top 10 chapters tested, a findings section with reproduction steps, CVSS vector, business impact, and prioritised remediation, an attack narrative reconstructing the path an attacker would take, and an appendix of testing evidence. We also deliver a remediation tracker as JIRA-importable CSV.

Yes — every engagement includes one free retest within 90 days of the report. We re-execute the proof-of-concept for every High and Critical finding, verify the fix, and reissue a clean retest letter you can hand to enterprise procurement or an auditor. Out-of-scope retests (more than 90 days, or expanded scope) are quoted at 30% of the original engagement. For continuous assurance, the annual 4-test bundle includes quarterly cadence and continuous retest within each quarter.

SOC 2 expects a regular pentest as evidence for CC4.1 monitoring and CC7.1 vulnerability identification; our reports are accepted by every major audit firm. PCI DSS v4.0.1 Req 11.4.3 requires annual external/internal penetration testing plus after any significant change; Req 11.4.5 requires segmentation testing (annual merchants, every 6 months service providers). HIPAA does not name 'penetration test' explicitly but §164.308(a)(8) requires periodic technical evaluation — pentests are the de-facto evidence. EU AI Act Article 15 requires accuracy, robustness and cybersecurity testing; DORA (Regulation (EU) 2022/2554) imposes Threat-Led Penetration Testing (TLPT) on significant financial entities from January 2025. We map every finding to the relevant control so the report does double duty in audits.

Per-engagement pricing. External Network Pentest is 5,500 EUR (5 business days testing + report) — internet-perimeter scope, up to ~50 hosts. Web Application Pentest is 8,500 EUR (8 days) — single application or tightly scoped multi-app, ASVS L2 by default. Mobile Application Pentest is 7,500 EUR (7 days) — iOS or Android, MASVS L1+R; both platforms quoted together at 13,500 EUR. API Pentest is 6,500 EUR (6 days) — single API surface, OWASP API Top 10 2023. Cloud Configuration Audit is 7,000 EUR (6 days) — single AWS/GCP/Azure account, CIS Benchmark + provider Well-Architected security pillar. Annual 4-test Bundle is 22,000 EUR — any combination of four tests through the year with priority scheduling, continuous retest, and a year-end executive summary across all engagements. Free retest within 90 days included on every engagement.