SaaS Penetration Testing: The Tests Your Enterprise Customers Ask For

SaaS penetration testing is a manual, authenticated test of your application, its APIs and the cloud environment behind it, built around the question your enterprise customers care about most: can one tenant see or change another tenant’s data? A general web application test looks for the usual vulnerability classes. A SaaS test also works through your tenant model, roles and permissions, single sign-on, integrations and release process, and produces a report you can use to answer customer security questionnaires.

Do SaaS companies need penetration testing?

Usually yes, though rarely because a law says so. The pressure comes from customers and audits:

• Customer questionnaires. Enterprise security questionnaires routinely ask when you were last independently tested, by whom, and whether high-risk findings were fixed. Without a current report, deals stall at procurement.
• SOC 2. Auditors look for evidence that you find and fix vulnerabilities, and a penetration test is the usual evidence. Our SOC 2 penetration testing page covers what auditors accept and when to test, and our guide to SOC 2 compliance explains the audit itself. Our comparison of SOC 2 Type 1 vs Type 2 explains which report to start with.
• ISO 27001. ISO/IEC 27001:2022 Annex A includes control 8.8 (management of technical vulnerabilities) and control 8.29 (security testing in development and acceptance). Penetration testing is a common way to evidence both, and our ISO 27001 consultancy helps you build testing into the management system.
• PCI DSS. If card data touches your platform, Requirement 11.4 makes internal and external penetration tests mandatory at least once every 12 months and after significant changes.

What does a SaaS penetration test cover?

It covers the application from three points of view: an outsider with no account, a normal user inside a customer tenant, and that customer’s administrator. Testing is usually grey box: we get credentials for each role plus API documentation, so the time goes on depth rather than guesswork.

Our web application penetration testing and API penetration testing pages describe each method in full, and assistants or agents built into your product are covered by AI and LLM penetration testing, whose results can also serve as evidence for an AI management system under ISO 42001 and for your wider AI governance programme. The cloud environment behind the product is covered in depth by AWS penetration testing services and Azure penetration testing, and a companion iOS or Android app by mobile app penetration testing.

How is multi-tenant isolation tested?

With at least two test tenants, each holding users at every role, so the tester can try every boundary from both sides. The tester captures requests made as tenant A and replays them with tenant B’s session, changes identifiers in URLs, bodies and headers, and checks indirect routes such as shared links, file downloads, CSV exports, email notifications and search results. Broken object level authorisation, first in the 2023 OWASP API Security Top 10, only shows up when the tester can act as a legitimate user, which is why authenticated testing matters so much for SaaS. Our API security checklist maps 20 checks your developers can run before each release to that list.

To get the most from the test:

1. Set up the test tenants with realistic data, including files and integrations.
2. Give the tester a role matrix: what each role should and should not be able to do.
3. Agree the environment. A production-like staging environment is safer for tests that change data; production is the only place to confirm real configuration.
4. Freeze the build under test, or tell us what will ship during the test window.

How often should a SaaS application be tested?

At least once a year, and again after significant changes such as a new authentication model, a new API version, a major feature that handles customer data or a move between cloud providers. Firms that ship weekly cannot test every release, so they combine approaches to SaaS security testing:

Tie the main test to your audit calendar, so it falls inside your SOC 2 audit period or before your ISO 27001 surveillance audit, with time to fix findings and retest.

What do enterprise customers ask for?

Most enterprise buyers send a security questionnaire, either their own or a standard one such as the Cloud Security Alliance CAIQ or the Shared Assessments SIG. The testing questions are predictable:

• the date of your last independent penetration test, and whether its scope covers the product they are buying;
• who performed it, and whether the testers are independent of your developers;
• the number and severity of open findings, and proof that critical and high findings were fixed;
• how often you test and scan;
• whether you hold ISO 27001 or a SOC 2 report.

If you hold neither yet, our comparison of ISO 27001 vs SOC 2 explains which buyers expect which, our guide to ISO 27001 for startups covers a lean first certification, and ISO 27001 certification cost sets out the budget. If customers also ask how your hosted service is run day to day, ISO 20000 certification covers IT service management and shares its structure with ISO 27001.

Our reports include an executive summary for non-technical readers and a full technical report with reproduction steps, CVSS ratings and remediation advice. Where a retest is in your proposal, we check your fixes and reissue the report showing the findings closed. The usual practice is to share the executive summary and retest results with customers under NDA, not the full technical report.

If your product takes or stores card payments for customers, PCI DSS applies too and you may be a service provider: see PCI compliance for SaaS and our PCI compliance service provider page.

What affects the cost and scope of SaaS penetration testing?

Scope drives the cost of SaaS pen testing. The main factors are the number of user roles, API endpoints and products in scope, how many authentication methods you support (passwords, SSO, API keys), whether cloud configuration and source code review are included, and whether a retest is needed. A short scoping call is enough to fix these and send a fixed-price proposal.

Why Sovereign Secure for SaaS testing?

• We test web applications, APIs, cloud, mobile apps, networks, source code and AI features, and run vulnerability scanning, so one provider can cover the whole platform.
• PCI SSC-approved QSA company, which matters when payment features bring PCI DSS into scope.
• ISO 27001 certified, working to the same standard many of your customers ask you about.
• Reports structured as evidence for PCI DSS Requirement 11.4 and ISO 27001 Annex A controls 8.8 and 8.29, with a retest of remediated findings available.

Get a fixed quote for your SaaS penetration test

Tell us about your product, its user roles and APIs, and the questionnaire or audit you need the report for. Use our penetration testing quote form, the enquiry form on this page, or call +44 161 523 5276.