Customer Security Reviews

Get independent security testing and the evidence you need to respond to customer security questionnaires. Every engagement includes an attestation letter, an executive summary and a technical report, with fixed pricing agreed before testing begins.

Get a Pentest Quote Book a Scoping Call

Accreditations and memberships

Why suppliers need a penetration test

There is no single standard behind a customer security review, so what you are asked for varies by buyer. These are the most common situations.

An enterprise prospect sends a questionnaire

Security questionnaires and vendor due diligence processes commonly ask whether your product has had an independent penetration test, when it happened and who carried it out.

A deal is waiting on the answer

A procurement team can hold a contract until the evidence arrives, so the timing of the test is as important as its scope.

You're moving upmarket

As you move from smaller customers to enterprises, expect more scrutiny of your security posture. A penetration test report gives prospective customers tangible evidence that you've independently assessed your product's security.

Regulated customers, investors and partners

Customers in financial services and healthcare, along with investors and commercial partners conducting due diligence, may ask for evidence of independent security testing before proceeding.

What Buyers Ask

Common questions in a security review, and what to send

The wording varies by buyer, so check the questionnaire itself. These are common questions and the evidence that usually answers them. For other frameworks, see our guidance on penetration testing for compliance.

Has the product had an independent penetration test in the last 12 months?

Answer with the date, the scope and the provider. The attestation letter records the scope and the testing dates, so it usually answers this question on its own.

Who carried it out, and are they accredited?

Provide the details of the provider, and the credentials and accreditations for both the company and the individual consultants.

What did the test cover?

For a SaaS product this is typically the web application and API, and includes the user roles and multi-tenancy being tested against the OWASP guidelines. See our SaaS penetration testing page for more.

Can we see the report?

Offer the attestation letter first, then the executive summary if the buyer wants detailed findings. The next section explains why we suggest holding back the full technical report initially.

Were the critical and high findings fixed?

Fix them, request a retest and then share the retest report or attestation.

Sharing Your Report

What to send a buyer, in this order

The attestation letter

It confirms the scope and dates of the assessment without disclosing individual findings. It may be sufficient for a buyer who needs confirmation that testing took place, although some questionnaires require additional evidence.

The main penetration testing report

The main report includes an executive summary of the assessment, its findings and associated risks, followed by detailed technical findings and remediation guidance. Share it when the buyer needs a detailed view of the test results.

The vulnerability report

This report details the identified vulnerabilities individually. Share it when the buyer needs more granular evidence of specific findings.

How It Works

From first contact to final report

Tell us what you need

Submit a quote request or book a scoping call. Tell us which product your customer is reviewing, share their security questionnaire if you have it, and let us know your deadline. You don't need a finished scope document. We'll reply within one business day to clarify requirements and agree the scope.

Receive a written, fixed-price proposal

The proposal confirms the scope, methodology, timing, rules of engagement and a fixed price. You accept when you're ready, and there's no obligation at any stage.

Testing, with direct access to your consultant

The person testing your product is the person who scoped your engagement, and critical findings are escalated to you the same day they're discovered.

Report delivery and debrief

Technical and executive reports are delivered within 2 business days of testing completion, followed by a debrief call. Retesting of remediated findings is included for remotely delivered web application, API, website and external network testing, and is agreed at scoping for internal testing.

Typical Scope and Price

A worked example from our published prices

A SaaS product with a multi-role web application and a standard API. Prices are indicative, exclude VAT and are confirmed as a fixed price after scoping. See the pricing guide for every service, or use the cost calculator.

What the buyer is reviewing	Testing	Indicative price
Web application with multi-tenancy and user roles	Web application penetration testing	£6,000 to £8,400
Standard API, 20 to 50 endpoints	API penetration testing	£2,950 to £5,050

What You Receive

Included in every engagement

Reports and attestation letter
An executive summary for the buyer's procurement team, a technical report with every finding, evidence, CVSS scoring and remediation guidance, and an attestation letter confirming the test was carried out to the agreed scope and methodology.
Debrief session
A video call or presentation to walk through findings and remediation priorities with your technical and security teams.
Retesting and platform access
Retesting where included for the service, with finding statuses updated so you can show what was fixed, and the attestation PDF available to download from the Exploitr platform at no extra cost.

Common Questions

Penetration testing for security reviews: frequently asked questions

How testing fits a customer security review, answered before you request a quote.

You can, but we suggest sending the attestation letter first. It confirms the test was carried out to the agreed scope and methodology without listing findings, which answers most questionnaire questions. If the buyer wants to know what was found, send the executive summary, which is written for non-technical readers.

The full technical report contains the detail needed to reproduce each finding, so share it only when the buyer needs it, under an NDA, and once the critical and high findings have been retested. Our reports are written with the expectation that they may be shared with third parties, but what you share is your decision.

We reply to every enquiry within one business day to confirm the scope, then send a written, fixed-price proposal. Our standard lead time from agreement to testing is 2 to 3 weeks, testing a typical SaaS product takes around 4 to 7 days, and the report follows within 2 business days of testing finishing. The attestation letter is available to download from the platform once the assessment is complete.

If a deal is waiting on the evidence, include the deadline in your quote request and we'll work to your timeline where possible. The earlier you ask, the more options we have.

There's no universal rule. Many questionnaires ask for a test within the last 12 months, and some buyers also ask about testing after major releases, so check your buyer's wording. NHS DTAC, for example, asks for a penetration test from the previous 12 months (see our healthcare penetration testing page).

If your product has changed significantly since your last test, say so when you reply and consider commissioning a new one.

Having findings in a report is normal. What buyers usually want to know is whether the critical and high ones were fixed. Fix what you can, request a retest and share the updated statuses: retested findings are marked as fixed or still open in the report and the Exploitr platform. Be straightforward about anything that remains, with your plan and timeline for fixing it.

Retesting is included for remotely delivered web application, API, website and external network testing, and is agreed at scoping for internal testing.

Ready to scope your penetration test?

Tell us about the product under review and your buyer's deadline, and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. No obligation at any stage.

Request a Quote