Penetration testing for startups.
An enterprise customer sent the security questionnaire. You need a real test, a report you can forward, and none of the procurement theatre. We scope it on a call, quote within a business day, and test the app the way an attacker would.
Three answers, with evidence.
Enterprise security questionnaires vary, but the penetration-testing section always comes down to the same three questions. A focused test answers all of them.
"Has an independent third party tested it in the last 12 months?"
Yes, with a dated report and a methodology section that names what was tested and how.
"What did they find?"
A severity summary and an executive page you can share without exposing the technical detail.
"Has it been fixed?"
A retest of the fixes and an updated report, which is what turns a finding into a closed item on their checklist.
Scope that fits a startup, not an enterprise.
You don't need a six-week programme to satisfy one customer. You need the test that finds what matters in your product and a report that reads well. Start focused; grow it when the business does.
Focused app test
Your web app, its API and every role, tested by hand. The usual choice for questionnaires and first audits.
App, mobile and API
Add the Android and iOS clients when customers use them, tested together so trust gaps show.
Release and annual
Targeted tests before big releases, then a yearly full test with findings tracked year on year.
The things a scanner can't see.
Tenant isolation
Whether one customer can read, change or delete another customer's data. The finding that ends enterprise deals.
Business logic
Plans, limits, invites, approvals and billing: the flaws that only make sense once you know the product.
APIs and integrations
Tokens, scopes, rate limits, webhooks and the OAuth flows that connect you to the customer's stack.
Cloud edges
Uploads, storage buckets, secrets and the parts of your cloud a web test can reach.
Hardening
Transport security, headers, cookies and the basics every questionnaire asks about.
Verified fixes
A retest of every finding you fix, so the closing report is evidence, not a promise.
Scope call to report you can forward.
Scope call
Twenty minutes on your app, roles and the deadline the customer gave you. A fixed quote within one business day.
Test
Manual testing across every role, on staging with test accounts, with automated coverage as the floor.
Report and debrief
Findings ranked by risk, with reproduction steps and fixes, walked through with whoever ships the fixes.
Retest
Once the fixes are in, we verify each one and update the report, which is the version your customer wants.
75+ engagements since 2013.
9 in 10 of them came from clients and partners who came back. Across 16 representative profiles we found and reported critical-severity issues in 10, and 9 included verifying the fixes. See the profiles and download a sample report.
Founders ask.
How long does it take?
It depends on the size of the app and how many roles it has, which is what the scope call settles. For a focused test of one app the whole thing, from kickoff to report, is measured in weeks, not months, and we agree the dates before you commit.
Can we share the report with our customer?
Yes, that is what it is for. The executive summary and severity table stand alone if you'd rather not hand over the technical detail.
We haven't got a staging environment yet.
Then we test production carefully: an agreed window, test accounts, and no actions that could touch real customer data. A staging copy is better and we'll say so, but it isn't a blocker.
Is the retest included?
It is optional and quoted up front, so you can decide once you know what was found. Most startups take it, because the retested report is the one customers accept without further questions.
What about SOC 2?
The same test is the evidence a SOC 2 auditor wants; see penetration testing for SOC 2 for the paperwork that goes with it.
Get secured.
Tell us what you're shipping. You'll get a scoped, fixed quote within one business day.