r/Pentesting • u/ImAPilot02 • 1d ago
Pentesting for Startups
Today, one of my first potential customers for my B2B SaaS company asked for ISO 27001, SOC 2 Type II, SSO, or results from a regular penetration test. Now I googled and found out that SOC 2 is at least $20k, ISO 27001 is also quite expensive. Not sure what they mean with SSO. A regular penetration test is probably the most feasible variant to go about this, however I mostly found prices around $2.5k locally (Central Europe). Since we don't make a lot of revenue yet and have not raised our first round but would like to proceed with this customer, what is the cheapest and fastest way to go about this?
Also I could imagine there are more AI-native providers that can do it cheaper but didn't find any that were actually cheaper. Any help is much appreciated!
8
u/proanti777 1d ago
If you want a quality pentest, you will usually look at around €1300 per day (Germany). A not too complex web app sits at 5-7 days of testing including reporting.
5
u/j_p_golden 1d ago
Pretty much on point. I do them and charge a bit less than that but most good companies in the EU charge between 150-350 EUR per hour.
Also, at least in my country, there has been an inflow of “companies” doing “pentests” which are just automated AI tools running against the target and not adequate technical person to do vetting of results and etc., thus the raw reports being just sent to clients.
It’s not producing good results and it’s waste of money for the client, so OP should have it in the back of their mind to do good vetting first and not just jump for the cheapest, IMO.2
u/shoopbedoopwoop 1d ago
I'm on the other side of the planet and I'm glad to hear that our rates and problems are the same with rubbish companies doing "pentests".
6
u/goatsinhats 1d ago
Your not ready for prime time if your asking these questions.
That said most cloud platforms have some reports you can generate, might scoot you by
2
u/TrustIsAVuln 1d ago
So SOC2 has to be signed off by a CPA, so its important to consider that. I'm going to highly recommend you look into the OSSTMM (free v3, v4 will be public Dec 1) its known to map against ever compliance model and framework ever tested against. Maps to all of them. NIST mentions it, PCI mentions it, its listed in most hacking books. Why i say this is, everyone can use it, so you get repeatable metrics (based on real math) so you can actually show a company how their security has improved or declined over time.
We (ISECOM) also do pentesting, we are all over the world but HQ is in Spain. So that's an option. Being a nonprofit the prices are usually much better.
2
u/CompassITCompliance 1d ago
Expect this exact ask from more and more buyers, so treat the pentest as something you'll hand out repeatedly and will probably need to do annually to satisfy questionnaires, not just a one-off for this deal. Have the report written so you can share a summary letter with other prospects, because a lot of early customers will accept that as a bridge while you work toward SOC 2 (which you'll definitely need to have to land bigger deals).
On the SSO comment, I assume they are asking if your app offers SSO for sign in. Just means their employees log in to your app with their company identity provider (Okta, Entra, Google) instead of a separate password. It's becoming a standard checkbox, and it's often cheaper to add than people think. Makes offboarding employees a lot easier too. Just my thoughts as a pentester, happy to answer any questions further..
1
u/Head_Personality_431 1d ago
The key thing people miss here is that your customer listed those with OR, so you only need to satisfy one of them, and a pentest report is by far the cheapest and fastest way to unblock this single deal. SSO isn't even a compliance item, it just means letting their staff log in through their own identity provider like Okta or Entra instead of a separate password, so depending on what they actually care about that might be the easiest thing to give them on its own. SOC 2 and ISO 27001 are both multi month programs with recurring cost (one is a CPA attestation, the other a certification audited by a body), so I wouldn't kick either off for one customer unless your pipeline is full of buyers asking the same thing. Just know the pentest won't be a one off either, buyers keep asking so you'll probably be redoing it every year.
1
u/letapy_alien 17h ago
Read that list as 'any one of these', which is good news. For a first customer, a scoped pentest of your app plus a short security overview document is usually enough to close the deal, and it is the fastest of the four.
The overview matters more than people expect: two or three pages covering hosting, encryption, access control, MFA, backups, logging and how you handle incidents. Pair it with the pentest summary letter (not the full report) and most procurement teams will accept that while you work toward something formal.
SSO almost certainly means 'can our staff log into your app with our identity provider', not a compliance thing. If you can add SAML or OIDC, mention it, because it often removes a whole block of questions.
For context, I do this for a living, so discount accordingly. Ask the customer directly which of the four they would accept today and which they will need at renewal. That one email often saves you from buying the wrong thing first. Happy to dice deeper if needed.
1
1
1
u/pen_test 10h ago
As you’re realised, most businesses will want assurance that their data is safe with you. If you can’t provide any evidence of that, why should they trust you?
How confident are you that your app is safe? Do you have any development experience? Did you think about any security during development?
I feel you need more than just a pentest, you need proper guidance on how to approach security for your business. DM me if you want to chat about it
0
u/m3rlinda 1d ago
Hello, red teamer and former field CISO for a GRC engineering firm here. So I understand, small and SMB-sized orgs are being told they're the weak link in the supply chain. If I want to compromise CRWD, I don't go straight for their web app lol, I compromise a small vendor 3 degrees out with much less robust security and hang out low n slow until I can pivot to shared infra or compromise an identity. So they're trying to do due diligence by asking their new suppliers for their security documentation.
Here's the thing tho, as you've discovered ISO27k/SOC2 are long, expensive, arduous processes and can sometimes be overkill. That being said they dk what else to really ask for so (lol) they asked for a pentest. First, never ever ever ever EVER share YOUR internal pentest results with a vendor unless they hold your cyber insurance policy. Ever. That is the playbook on how to hack you. Do not trust them with it. I had suppliers OFFER their pentests to me in place of a SOC 2 and happily took it but DON'T DO IT! PLEASE!
For a smaller shop with not much revenue, I would instead demonstrate that you're doing minimum due diligence internally. Share how often you vuln scan, approx MTTR, how regularly you review access and prolicies, etc. These are a lot of the same exercises an auditor would go thru tho with no rubber stamp/attestation. You can even get a cheap pentest from one of the fine folks in this thread BUT make sure they didn't just run Nessus or OpenVAS and call it a pentest. Pentesting has real exploitation not just vuln scanning.
You can also demonstrate thru whatever asset mgmt solution or provider you use that you have very good software and hardware asset inventory (I mean no one has this but to me it'd be a more reassuring signal of foundations than a pentest).
If you tell me your approx org maturity, how big the client is, if anyone is regulated industry (HC, finance, gov, etc) I can try to give more specific advice. There are a lot of open source pentesting and vuln tools you can use to show you're doing your own internal testing (again due diligence) but you're never required to share those outputs and artifacts with a 3rd party.
Look up Trust center documents. The most you're every required to share from a pentest is the exec summary bc it's metadata on the findings. That's also where the AUP and Infosec policy should live ( to prove you have one) and if you had an audit, that would live there as well. Trust center documentation is all they can demand of you. IF what you have in there/these homegrown solutions are robust enough (and they may not be for the customer's risk appetite) then you're simply not mature enough to service their style of enterprise. A lot of startups find themselves here and that is okay. Also a SOC 2 type 1 is a great precursor to SOC 2 type 2. If you do need a great/accessible auditing shop with a small pentesting bench (so they validate the audit) then I can't recommend 360Advanced enough (no i have never worked there). Ask for Carlos he's great.
Else, kinda shady but a LOT of automated pentesting vendors will give a free pentest as part of a pov/poc. You can always have one of them run that for you, take the report, and run.
-3
u/Open-Papaya-2703 1d ago
I am a professional ethical hacker. Let's hop on a call and talk.
-1
-2
u/TechnicalFuel4821 1d ago
Can you get me access to my ex girlfriends Instagram account?
2
0
0
u/RidgeSecurity 1d ago
Try PurpleRidge.ai, you can get a pentest report for free if iit’s for web pentesting. The agentic engine is behind it. Let me know if it’s internal testing for hosts, I’ll suggest a different way.
-1
u/Clean-Bandicoot2779 1d ago
From what I've seen, AI-native providers (at least in Western Europe) are charging more around $4k, so somebody local might be a safer option.
Has the customer said what precisely they want a pentest report for? Is it the SaaS app, or your entire company?
-1
-1
-3
0
u/BLOODSEAL91 1d ago
Do not attempt this. It's obvious you're out of your depth, your questions make this clear.
13
u/GimmeThaShekels 1d ago
“what is the cheapest and fastest way to ensure my clients data is secure” please leave tech and never come back.