What should a SaaS pentest cover?
Start with the system your customer is buying. A quote for one web application can mean different things if your product has a public API, separate admin console, multiple tenant types, and SSO. List these boundaries so providers price the same work.
- Applications and environments: domains, APIs, production-like test targets, and excluded infrastructure.
- Roles and tenants: normal users, administrators, support roles, and separate customer organizations.
- Authentication: sign-up, recovery, sessions, SSO, and service credentials.
- Workflows: invitations, exports, billing, approvals, uploads, and integrations.
- Constraints: test windows, provider permissions, prohibited actions, and escalation contacts.
The OWASP API Security Top 10 helps identify authorization and API risks. Use it as one input to scope; your business workflows still need explicit coverage.
Make tenant isolation explicit
Provide representative accounts in at least two test tenants and define expected access. Ask how the provider will examine object access, file downloads, exports, searches, background jobs, and administrative actions. Use synthetic records that make tenant ownership clear.
Testing should consider the application and its APIs. Hiding a function in the interface does not establish that a lower-privileged user cannot call it. A useful report describes the tested boundaries and limitations rather than simply marking multi-tenancy as passed.
How much does a SaaS pentest cost?
DevBrows SaaS Pentest starts at $3,450 USD . Complex enterprise environments or multi-product architectures: $12,000–$18,000+. These are DevBrows pricing anchors, not a claimed market average. Your quote reflects the agreed surface and depth.
| Factor | Effect on scope |
|---|---|
| Roles and tenant types | More permission boundaries to examine. |
| API operations and workflows | Coverage follows behavior and access rules, not page count. |
| SSO and integrations | Additional identity and third-party trust boundaries. |
| Multiple apps or AI features | Additional objectives, access requirements, and testing effort. |
Compare quotes using the same scope and exclusions. Cloud infrastructure, mobile, source review, and AI should not be assumed to fit inside one starting price. AI Application & Agent Security starts at $4,950 USD and can be scoped alongside SaaS testing.
Specify the report and retest
Before booking, identify the reviewer who will accept the report. Confirm required scope, testing approach, provider qualifications, report age, unresolved-finding policy, and retest evidence. Put these criteria in the proposal and confirm feasibility with the provider. The reviewer still decides acceptance.
Ask for a role, tenant, and workflow coverage matrix alongside the buyer evidence summary. It should distinguish tested boundaries, excluded paths, observed findings, and fixes verified during the retest.
Request an executive summary and a technical report. Findings should state the affected asset, required conditions, reproducible evidence, business impact, severity rationale, and recommended fix. Record methodology, dates, scope, and limitations too.
Agree the retest window before signing. DevBrows includes one retest of agreed findings, with timing and boundaries in the proposal. New functionality or an expanded surface requires additional scope. Keep the initial report, remediation record, and retest result together so a reviewer can distinguish open findings from verified fixes.
Schedule backward from the evidence deadline
Allow for access setup, testing, engineering fixes, retesting, and stakeholder review. A buyer’s report deadline is not the day testing should start. Confirm availability and dates during scoping rather than assume a universal turnaround.
If testing supports an audit, align it with the auditor’s evidence expectations. Read the SOC 2 pentest guide before buying solely because someone said it is required. When a buyer request is unclear, the $2,250 Security Gate Sprint can first turn it into an action plan.
Questions to ask a pentest provider
- Which roles, tenants, APIs, and workflows are included?
- How will findings be manually validated?
- What access and documentation must engineering prepare?
- How are urgent findings communicated?
- What does the retest cover, and when is it available?
- Which assumptions or exclusions could change the quote?
A useful proposal answers these before you commit. Scope the product you operate and the evidence your reviewer needs.
Make multi-tenant coverage explicit
Provide test accounts for at least two tenants and the distinct roles in scope. Document which objects, exports, background jobs, integrations, and administrative actions each identity may access. Include invitations, role changes, account recovery, and tenant switching where relevant.
The scope should examine server-side authorization across web and API paths, rather than rely on the interface hiding another tenant’s objects. Ask how shared storage, search, caches, and asynchronous processing are covered. For AI-enabled features, include retrieval and tool identities in the AI assessment scope.
Broader SaaS scopes and multi-tenant platforms: $5,500–$8,500+. Complex enterprise environments or multi-product architectures: $12,000–$18,000+. These are DevBrows commercial bands, not a claim about a market average. Scope, roles, environments, integrations, and test depth determine the proposal.