Authentication and sessions
Test agreed login, session, recovery, SSO, and service-identity paths. Confirm how identities are established and how access changes over a session.
Web · API · Multi-tenant products
SaaS Pentest
Independent testing of the product your enterprise customer is buying.
For CTOs, security leads, and engineering owners with a required customer pentest, audit evidence request, or material product change. Start with the system and the reviewer who will evaluate the report.
Scope & deliverables
What the engagement covers.
Authorization and tenant isolation
Examine role, object, function, and tenant boundaries using representative accounts and synthetic records. Cover agreed exports, uploads, admin, and support functions.
Business logic and integrations
Test the agreed business workflows: invitations, subscriptions, approvals, webhooks, payment flows, and integrations that affect valuable data or actions.
Reports, guidance, and one retest
Receive a role, tenant, and workflow coverage matrix, buyer evidence summary, technical findings, remediation guidance, an engineering workshop, and one scoped retest. Included workshop time and the retest window are defined in the proposal.
Before commissioning
Confirm what the reviewer will accept.
Report requirements
Identify the customer or auditor reviewing the report. Confirm required scope, methodology, tester qualifications, report age, finding status, and whether a retest is required. Check feasibility before booking; acceptance remains the reviewer’s decision.
A visible coverage record
Connect each agreed role, tenant, API, and business workflow to expected access, test status, evidence, and exclusions. Review the illustrative coverage record before agreeing your scope.
Commercial scope
Know what you are commissioning.
Starts at $9,500 USD. Larger scopes: $12K–$18K+; complex engagements: $20K–$30K+. Final pricing reflects applications, roles, tenants, APIs, business logic, and integrations. AI, cloud infrastructure, mobile, and source review are separately scoped.
Before work begins, agree delivery dates, authorized access, exclusions, data handling, and payment terms. Review our methodology and report expectations.
Practical answers
Before we start.
How do you test multi-tenancy?
We agree expected access rules and representative accounts in separate test tenants. Testing follows relevant object, role, export, file, administrative, and API paths; the report records coverage and limitations.
What must be ready before testing?
Written authorization, rules of engagement, representative roles and tenants, a suitable environment, API documentation, synthetic data, and technical contacts. We confirm readiness and dates before starting.
What is included in a retest?
SaaS and AI assessments include one retest of the agreed findings. The proposal defines the retest window, environment, and scope. New features or additional attack surfaces require a scope change.
Is this a SOC 2 or ISO certification?
Security reviews and testing provide supporting evidence. DevBrows does not issue a SOC 2 audit opinion or ISO certification, and buyer or auditor approval is not guaranteed.
Prepare for the engagement
Relevant buyer guides.
SaaS Penetration Testing: Scope & Cost
Practical guidance for scope, evidence, and the next security decision.
SOC 2 Penetration Testing: Scope & Evidence
Practical guidance for scope, evidence, and the next security decision.
Start with a scoped conversation
Bring the requirement.
Bring the requirement.
We’ll define the right scope.
Share your product, buyer requirement, and target date. We’ll confirm the engagement, deliverables, and commercial terms before work begins.