The complete guide to penetration testing for SaaS companies

This guide is for founders, CTOs, heads of security and revenue teams who keep getting asked for “your latest pentest report” in security questionnaires. Most SaaS companies buy their first penetration test because a deal or an audit forces it, which is why so many first tests are scoped badly and priced blind.

After reading, you should be able to tell which frameworks actually require testing and which only expect it, pick a delivery model (consultancy, PTaaS platform, bug bounty or automated testing), write a scope a tester can price, judge a report, and set a sensible cadence.

This is an editorial guide, not legal or compliance advice, and it is not a substitute for a qualified assessor, auditor or QSA reviewing your specific environment.

Summary

• SOC 2 and ISO 27001 do not name a mandatory pentest. Auditors still expect evidence that your controls work, and a test is the usual evidence.
• PCI DSS v4.0.1 is the framework with hard rules: internal and external tests at least every 12 months, after significant changes, and a retest of fixes.
• The proposed HIPAA Security Rule update would add annual pentests, but as of October 2026 it is still a proposal.
• For a typical SaaS product, the test that matters is an authenticated, grey box test of the web app and its API, focused on authorization between tenants.
• Consultancies, PTaaS platforms, bug bounties and automated tools solve different problems. Most companies need one manual test a year plus something continuous.
• Vendor-published list prices for a web app or API test cluster around $5,000 to $30,000 as of October 2026. Scope, not brand, drives most of the spread.
• A report without a retest letter is half a deliverable.

1. What a penetration test is, and what it is not

NIST’s glossary, drawing on SP 800-115, describes penetration testing as security testing in which assessors mimic real-world attacks to find ways around a system’s security features.¹1 Source: NIST CSRC, “Penetration testing” (glossary), accessed Oct 2026. The key word is mimic. A tester uses the same tools and techniques an attacker would, then tries to exploit what they find, and writes down how.

That separates a pentest from three neighbors:

• A vulnerability scan. Automated and shallow. It lists known weaknesses but does not test whether User A can read User B’s invoices.
• An audit or attestation. SOC 2 and ISO 27001 assess whether your controls exist and operate. A pentest is one piece of evidence that feeds them.
• A red team exercise. A longer, goal-driven adversary simulation that also tests detection and response. Usually overkill for a Series A SaaS company.

The UK’s National Cyber Security Centre (NCSC) frames a pentest as a way of gaining assurance, comparing it to a financial audit that checks your internal controls rather than replacing them.²2 Source: National Cyber Security Centre, “Penetration testing”, accessed Oct 2026. NCSC’s provider advice is aimed at UK government buyers (the CHECK scheme), but its scoping and reporting guidance applies generally. The OWASP Web Security Testing Guide is blunter: it calls penetration testing on its own “too little too late” in the software lifecycle and says it should not be the primary or only testing technique.³3 Source: OWASP, “Web Security Testing Guide v4.2: Introduction”, accessed Oct 2026.

2. Why SaaS companies get tested

Customers usually come before frameworks. Enterprise security questionnaires ask for a recent third-party test and proof that critical findings were fixed. Verizon’s 2025 Data Breach Investigations Report found that exploitation of vulnerabilities as an initial access step grew 34% and accounted for 20% of breaches, and that third-party involvement in breaches doubled to 30%.⁴4 Source: Verizon, “2025 Data Breach Investigations Report” news release, accessed Oct 2026. Your customers are the “third party” in their own risk register.

The frameworks are where most confusion lives, so here is what each one actually says.

SOC 2

SOC 2 reports are built on the AICPA’s Trust Services Criteria. Penetration testing appears as an example in a point of focus under the monitoring criteria (CC4): management “uses a variety of different types of ongoing and separate evaluations, including penetration testing.”⁵5 Source: Linford & Co, “SOC 2 Security Trust Services Criteria”, accessed Oct 2026. The AICPA’s own criteria document sits behind a free account; the wording here is as reproduced by Linford & Co. Points of focus illustrate how a criterion might be met. They are not individually required. Linford & Co, a CPA firm that performs SOC 2 audits, says that an external penetration test is not required for SOC 2, while calling it an important part of a company’s risk assessment.⁶6 Source: Linford & Co, “External Penetration Testing & SOC 2 Reports: How Are They Related?”, accessed Oct 2026.

In practice, auditors will ask how you validate that controls work, and a pentest with fixed findings is the simplest answer.

ISO/IEC 27001

ISO 27001 does not name penetration testing as mandatory either. Two Annex A controls are where testing evidence usually lands. Control 8.8, management of technical vulnerabilities, requires that information about technical vulnerabilities be obtained, exposure evaluated and appropriate measures taken.⁷7 Source: High Table, “ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities”, accessed Oct 2026. The standard itself is sold by ISO; control wording is as quoted by this practitioner source. Control 8.29, security testing in development and acceptance, requires a defined security testing process for new and changed systems, and practitioner guidance lists penetration tests among the expected activities.⁸8 Source: ISMS.online, “ISO 27001

Annex A 8.29 Security Testing in Development and Acceptance”, accessed Oct 2026. ISO sets no cadence. Your own risk assessment and documented procedures do.

PCI DSS v4.0.1

If you store, process or transmit cardholder data, or can affect its security, PCI DSS is the one framework with explicit pentest rules. As summarized from the standard’s Requirement 11.4:⁹9 Source: Strike, “PCI DSS penetration testing: what Requirement 11.4 asks for”, accessed Oct 2026. Secondary summary of PCI DSS v4.0.1; the PCI SSC document library was not accessible to us, so confirm requirement wording with your QSA.

• 11.4.1 A documented methodology covering the full cardholder data environment (CDE) perimeter and critical systems, testing from inside and outside the network, and segmentation validation.
• 11.4.2 and 11.4.3 Internal and external penetration tests at least once every 12 months and after any significant infrastructure or application upgrade or change, by a qualified internal resource or qualified external third party with organizational independence. The tester does not need to be a QSA.
• 11.4.4 Exploitable vulnerabilities are corrected and the test is repeated to verify the fixes.
• 11.4.5 and 11.4.6 Segmentation controls tested every 12 months, or every six months for service providers.
• 11.4.7 Multi-tenant service providers must support their customers’ external penetration testing. This became mandatory on March 31, 2025.

Many SaaS companies shrink this scope by using a payment provider’s hosted checkout. Confirm scope with a QSA before buying a PCI-specific test.

HIPAA

The current HIPAA Security Rule does not mention penetration testing. It requires a “periodic technical and nontechnical evaluation” of how well your safeguards meet the rule’s requirements.¹⁰10 Source: Cornell Law School LII, “45 CFR § 164.308 Administrative safeguards”, accessed Oct 2026. A proposed update, published as a notice of proposed rulemaking in January 2025, would require vulnerability scanning at least every six months and penetration testing at least every 12 months, by qualified people, for systems handling electronic protected health information (ePHI).¹¹11 Source: Cloud Security Alliance (republished from VikingCloud), “The HIPAA Security Rule Is About to Change”, accessed Oct 2026. As of September 2026 the rule had not been finalized; the federal regulatory agenda lists July 2027 as the planned final action date, which is a planning estimate, not a deadline.¹²12 Source: Bright Defense, “HIPAA Security Rule Update”, updated September 21, 2026, accessed Oct 2026. If you sell to hospitals or insurers as a business associate, expect their questionnaires to ask for annual tests now anyway.

Framework	Names pentesting?	Frequency set by framework	What auditors usually want to see
SOC 2 (TSC)	As an example in a point of focus (CC4)	None	A recent test, findings tracked to closure
ISO 27001	No; evidence for Annex A 8.8 and 8.29	None; set by your risk assessment	Documented testing procedure, results, remediation
PCI DSS v4.0.1	Yes, Requirement 11.4	12 months and after significant change; segmentation 6 months for service providers	Methodology, internal and external tests, retest evidence
HIPAA (current rule)	No; “periodic evaluation”	None	Risk analysis and evaluation records
HIPAA (proposed)	Yes	Pentest 12 months, scans 6 months	Not final as of October 2026

Security reviews are one step in a longer B2B deal; the complete guide to building a B2B revenue stack covers the systems around them.

3. Types of test

Tests vary along two axes: how much the tester knows, and what they are pointed at.

Knowledge level: black, grey and white box

• Black box. The tester starts with only a URL or IP range. OWASP notes that penetration testing is commonly called black-box testing, with testers accessing the application as users would.³ For a SaaS product where the valuable functionality sits behind login, it spends paid days on reconnaissance.
• Grey box. The tester gets test accounts for each role, API documentation and sometimes an architecture diagram. This is the default for SaaS for a reason: the worst bugs are usually authorization failures between users and tenants, and you cannot find those without accounts.
• White box. The tester also gets source code, infrastructure-as-code and configuration access. It finds more per day and costs more. Useful for a major release, an authentication rewrite or a product that handles payments or health data.

Target: what gets tested

• Web application. The product UI. Covers authentication, session handling, authorization, input handling and business logic.
• API. For most SaaS companies, the real attack surface. The OWASP API Security Top 10 (2023) puts Broken Object Level Authorization first, followed by Broken Authentication and Broken Object Property Level Authorization.¹³13 Source: OWASP, “OWASP Top 10 API Security Risks – 2023”, accessed Oct 2026. Those are exactly the multi-tenant failures that leak one customer’s data to another.
• Cloud configuration. IAM policies, storage permissions, network exposure, secrets handling in AWS, Azure or GCP. Cloud providers set rules here. AWS, for example, allows customers to test permitted services such as EC2, RDS, Lambda and API Gateway without prior approval, but prohibits denial-of-service testing and requires prior approval for testing that includes command and control.¹⁴14 Source: Amazon Web Services, “Penetration Testing”, accessed Oct 2026.
• Mobile application. If you ship iOS or Android apps, OWASP’s MASVS and its companion testing guide (MASTG) define the controls and test procedures.¹⁵15 Source: OWASP, “Mobile Application Security Verification Standard (MASVS)”, accessed Oct 2026.
• Network. External tests cover what faces the internet. Internal tests matter mainly if you run offices, VPNs or self-hosted infrastructure.
• Social engineering. Phishing and pretexting against staff. Often excluded by default, so request it explicitly if you want it.

4. Methodology standards

A competent provider can name the methodology they follow and show how their report maps to it. Three come up most often.

• OWASP Web Security Testing Guide (WSTG). The reference for web application testing. The latest stable version is 4.2; version 5.0 is in development.¹⁶16 Source: OWASP, “Web Security Testing Guide” project page, accessed Oct 2026. It is organized as a catalog of test cases (identity management, authentication, authorization, session management, input validation, business logic and more), which makes it useful as a checklist when you review coverage.
• Penetration Testing Execution Standard (PTES). Defines seven phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation and reporting.¹⁷17 Source: PTES, “The Penetration Testing Execution Standard” (readthedocs mirror), accessed Oct 2026. The mirror describes itself as an unofficial fork; the official site is pentest-standard.org, which did not load for us. It is less about specific test cases and more about how an engagement should run end to end.
• NIST SP 800-115. The “Technical Guide to Information Security Testing and Assessment,” published in September 2008. It covers planning tests, running them, analyzing findings and developing mitigation strategies.¹⁸18 Source: NIST, “SP 800-115, Technical Guide to Information Security Testing and Assessment”, accessed Oct 2026. Old, but still widely referenced, including in PCI DSS methodology discussions.

You do not need to pick one. A good SaaS engagement uses PTES-style structure, WSTG and the OWASP API Top 10 for test cases, and the cloud provider’s rules for infrastructure. Reject a provider who cannot tell you which test cases they ran.

5. Delivery models

There are four ways to buy offensive testing in 2026. They overlap at the edges, and vendors increasingly sell more than one.

Traditional consultancy. Named testers work a fixed number of days against an agreed scope, then deliver a report and usually a retest. Strengths: depth and business-logic testing. Weaknesses: lead time, and quality depends on which individuals you get.

PTaaS (penetration testing as a service) platforms. A platform sells testing time in standardized units, matches you with vetted freelance or in-house testers, and delivers findings in a dashboard with integrations to ticketing tools. Cobalt, for example, sells annual credits, where one credit is the equivalent of eight hours of testing, and says it offers unlimited on-demand retesting during the contract term, with start times as short as one to three business days depending on tier.¹⁹19 Source: Cobalt, “Pricing”, accessed Oct 2026. List prices and terms according to the company’s pricing page; the $3,500 autonomous test is described as a limited-time offer ending December 31, 2026. Strengths: speed, retests, ticketing integrations. Weaknesses: less continuity of testers.

Bug bounty programs. You publish a scope and pay researchers for valid vulnerabilities they report. HackerOne describes this as directing spending toward valid, high-impact vulnerabilities, with testing that runs continuously between scheduled assessments.²⁰20 Source: HackerOne, “Bug Bounty Platform”, accessed Oct 2026. HackerOne does not publish program prices. Weaknesses: noisy triage and no coverage guarantee, so buyers still want a scoped test alongside it. A bug bounty is not for a company that cannot yet fix findings quickly.

Automated and AI-assisted testing. Scanners and attack-surface monitoring have existed for years. Newer products add AI agents that attempt exploitation and write findings. Cobalt lists an autonomous pentest at $3,500 per test (a limited-time offer) and Intruder lists an AI pentest starting from $3,500 per test, both as list prices as of October 2026.¹⁹²¹21 Source: Intruder, “Pricing”, accessed Oct 2026. List price according to the company’s pricing page, excluding VAT. These are worth using between manual tests. Treat any claim that they replace a human test with caution: OWASP’s position is that automated tools “do not think creatively” and that automating black-box testing will never be completely effective.³ Business-logic and tenant-isolation flaws are where that gap shows.

Model	How it is priced	Typical cadence	Good at	Weak at	Satisfies a customer asking for a “third-party pentest”?
Consultancy	Fixed fee for scoped days	Annual or per release	Depth, business logic, attestation letters	Lead time, tester variance	Yes
PTaaS platform	Credits or per-test subscription	Annual plus on-demand	Speed, retests, ticket integration	Continuity of testers	Usually, check the letter format
Bug bounty	Platform fee plus payouts per valid finding	Continuous	Breadth, long tail of bugs	Coverage guarantees, triage load	Rarely on its own
Automated / AI-assisted	Subscription or per test	Continuous or monthly	Regression, known issues, attack surface drift	Logic flaws, authorization chains	Depends on the buyer; often no

For AI agents more broadly, including their own security risks, see the complete guide to AI agents in enterprise operations.

6. Scoping, timelines, reports and retesting

Scoping

Scope is where money is won or lost. NCSC recommends that scoping involve risk owners, technical staff who know the system and someone from the testing team, and that the output be a plan covering technical boundaries, test types, effort (usually in resource days), scenarios and reporting requirements.²

For a SaaS product, a scope a tester can price usually lists:

• The environments in scope (a production-like staging environment is usually best, with production read-only checks if agreed).
• Domains, API base URLs and the API specification (OpenAPI or similar), with endpoint counts.
• User roles, with two accounts per role in two separate tenants so cross-tenant access can be tested.
• Integrations and SSO flows, file upload paths, payment flows and admin consoles.
• Cloud accounts in scope, if any, and read-only credentials for configuration review.
• What is out of scope (third-party services you do not own, denial of service, social engineering unless requested).
• Rules of engagement: testing windows, emergency contacts, stop conditions, and a signed authorization to test.

Share your recent scan results. NCSC suggests giving testers your current vulnerability assessment so they can check its accuracy rather than rediscovering it.²

Timelines

Contracting with a consultancy usually takes longer than with a PTaaS platform. Testing itself is short. One provider’s published planning ranges put a SaaS web application test at roughly one to three weeks and an API test at one to two weeks, depending on complexity.²²22 Source: Blaze Information Security, “Penetration Testing Cost & Pricing in 2026: Buyer’s Guide”, published May 11, 2026, accessed Oct 2026. Planning ranges from a provider that sells these services. Leave time after the report for fixes and a retest. If you need a clean letter for a deal closing at quarter end, start six to eight weeks earlier than feels necessary; this is general guidance, not a sourced benchmark.

What a good report contains

NCSC says a report should include the security issues found, the testers’ risk assessment of each, a remediation method for each, an opinion on the accuracy of your own vulnerability assessment, and advice on improving it.² In practice, look for:

• A short executive summary, plus scope, dates, tester names and methodology.
• Each finding with severity (often CVSS-based), affected assets, reproduction steps, evidence and specific remediation.
• A clear note of what was not tested and why.
• A separate attestation or summary letter you can share with prospects under NDA, without exploit details.

Retesting

Fixing findings without verifying them leaves the risk register open. PCI DSS makes this explicit in Requirement 11.4.4.⁹ Ask whether retesting is included in the price, within what window, and whether you get an updated report or letter showing findings as closed. Enterprise buyers increasingly ask for exactly that letter.

7. What it costs

Independent pentest price surveys are scarce. What exists are vendor-published planning ranges, written by companies selling the service.

As of October 2026, these are list or planning prices published by providers:

Test type	Synack published range2323 Source: Synack, “How Much Does a Pentest Cost? 2026 Trends and Insights”, published June 25, 2026, accessed Oct 2026. Ranges from a provider that sells these services.	Blaze Information Security published range22
Web application	$5,000–$30,000	$5,000–$30,000
API	$5,000–$30,000	$5,000–$20,000
Mobile application	$7,000–$35,000	$5,000–$30,000
Cloud	$10,000–$50,000	$10,000–$40,000+
External network	$4,000–$12,000	$5,000–$20,000
Internal network	$5,000–$35,000	$7,000–$35,000

Blaze breaks SaaS web applications down further: roughly $4,999–$8,999 for a simple app (three to seven testing days), $8,999–$20,000 for a medium one, and $20,000–$30,000+ for a complex app with SSO, payments and admin portals.²² At the automated end, the $3,500 per-test AI offerings mentioned in chapter 5 set a floor for what “a test” can mean.¹⁹²¹

Pricing models

• Fixed fee per engagement. Most consultancies. Price is effectively days times day rate, quoted as a fixed number.
• Time and materials. Hourly or daily billing. Blaze cites $250–$300 per hour as a common professional services rate.²² Fine for open-ended work, risky for budgets.
• Credits or subscriptions. PTaaS platforms. Cobalt’s credits are eight hours of testing each and, per its FAQ, do not roll over between contract terms.¹⁹
• Per finding. Bug bounties. Cost follows results, plus a platform fee.

Price moves with user roles, API endpoints, integrations, white box access and included retests. Ask how many tester-days a quote buys.

8. Choosing a provider, setting a cadence, avoiding mistakes

Certifications and accreditation

Two credential types matter, one for people and one for firms.

• Individual: OSCP and similar. OffSec Certified Professional (OSCP) is earned through a 24-hour proctored, hands-on exam covering standalone machines and an Active Directory set. OffSec also issues OSCP+, which expires after three years unless renewed; the base OSCP does not expire.²⁴24 Source: OffSec, “PEN-200: Penetration Testing with Kali Linux (OSCP)”, accessed Oct 2026. Web-focused and cloud-focused certifications exist too. A certification shows a baseline. It does not show the tester knows multi-tenant SaaS.
• Firm: CREST accreditation. CREST accredits testing companies after reviewing evidence on company processes, service methodologies and data security practices, with periodic reassessment.²⁵25 Source: CREST, “Accreditation”, accessed Oct 2026. Accreditation is service-specific, so check that penetration testing itself is covered. CREST is more common as a buyer requirement in the UK, Europe and Asia-Pacific than in the US.

PCI DSS does not require a specific certification. It requires the tester be qualified and organizationally independent.⁹

What to ask before signing

• A redacted sample report. This is the single best predictor of what you will get.
• Names and certifications of the testers who will actually do the work, and whether they are employees or contractors.
• Methodology references, and a list of test cases for web and API work.
• Whether retesting and an attestation letter are included.
• Insurance: professional liability (errors and omissions) and cyber coverage, with certificates. Have your own counsel or broker set the limits you need; we have no sourced benchmark to give you.

Who should not run your test: the firm that built your product, your SOC 2 auditor, or anyone who cannot show you a sample report.

How often to test

PCI DSS sets the clearest floor: at least every 12 months and after significant change.⁹ The proposed HIPAA rule would mirror that.¹¹ For everyone else, annual testing has become the de facto expectation because enterprise questionnaires ask for a report less than 12 months old. Add a focused test after material changes such as a new authentication system, a new public API or a major migration, and run automated testing in between.

Common mistakes

• Buying black box for a logged-in product. You pay for reconnaissance and get a report about your marketing site.
• One account per role. Without two tenants, nobody tests cross-tenant access, which is the finding enterprise buyers care about most.
• Treating a scan as a pentest. Buyers increasingly read reports closely. An automated scan with a cover page will be noticed.
• Skipping the retest. An open critical finding in a shared report is worse than no report.
• Outsourcing the risk decision. NCSC’s guidance is that vulnerability risk assessment and mitigation is a business process and should not be wholly outsourced to the test team.²

Security commitments often end up in customer contracts; our guide to AI contract review covers how teams review agreements at volume.

9. The verdict

For most B2B SaaS companies, the right program is one manual, authenticated grey box test a year of the web app and API, scoped around tenant isolation, followed by a retest and a shareable letter. Layer automated testing on top between tests. Bug bounties come later, once you can fix findings quickly.

Frequently asked questions

Does SOC 2 require a penetration test?

Not by name. Penetration testing appears as an example in a point of focus under the monitoring criteria, and points of focus are not individually required. Most auditors still expect some evidence that your controls are tested, and a recent pentest with closed findings is the most common way to provide it.

Is a vulnerability scan enough for compliance?

For PCI DSS, no: scans and penetration tests are separate requirements. For SOC 2 and ISO 27001, a scan may satisfy parts of vulnerability management, but enterprise customers asking for a “third-party pentest” generally mean a manual test with exploitation and a written report.

Should we test staging or production?

Usually a production-like staging environment, plus agreed checks against production for things that only exist there, such as edge configuration. Write the choice into the rules of engagement.

Can an AI pentest replace a human one?

Not yet for most buyers. Automated tests find known weakness classes quickly and cheaply. Business-logic and cross-tenant authorization flaws still need a human who understands how the product should behave.

Can we share the full report with prospects?

You can, but you usually should not. Share an executive summary or attestation letter under NDA that states scope, dates, provider and the status of findings. Keep reproduction steps internal.

Do we need a CREST-accredited provider?

Only if a customer, regulator or tender requires it, which is more common outside the US. CREST accreditation is a useful signal of process maturity, but the sample report and the named testers tell you more about the quality of your specific engagement.

Sources and notes

1. Source: NIST CSRC, “Penetration testing” (glossary), accessed Oct 2026. ↩

2. Source: National Cyber Security Centre, “Penetration testing”, accessed Oct 2026. NCSC’s provider advice is aimed at UK government buyers (the CHECK scheme), but its scoping and reporting guidance applies generally. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

3. Source: OWASP, “Web Security Testing Guide v4.2: Introduction”, accessed Oct 2026. ↩ ↩² ↩³

4. Source: Verizon, “2025 Data Breach Investigations Report” news release, accessed Oct 2026. ↩

5. Source: Linford & Co, “SOC 2 Security Trust Services Criteria”, accessed Oct 2026. The AICPA’s own criteria document sits behind a free account; the wording here is as reproduced by Linford & Co. ↩ ↩²

6. Source: Linford & Co, “External Penetration Testing & SOC 2 Reports: How Are They Related?”, accessed Oct 2026. ↩

7. Source: High Table, “ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities”, accessed Oct 2026. The standard itself is sold by ISO; control wording is as quoted by this practitioner source. ↩

8. Source: ISMS.online, “ISO 27001

   Annex A 8.29 Security Testing in Development and Acceptance”, accessed Oct 2026. ↩

9. Source: Strike, “PCI DSS penetration testing: what Requirement 11.4 asks for”, accessed Oct 2026. Secondary summary of PCI DSS v4.0.1; the PCI SSC document library was not accessible to us, so confirm requirement wording with your QSA. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

10. Source: Cornell Law School LII, “45 CFR § 164.308 Administrative safeguards”, accessed Oct 2026. ↩

11. Source: Cloud Security Alliance (republished from VikingCloud), “The HIPAA Security Rule Is About to Change”, accessed Oct 2026. ↩ ↩²

12. Source: Bright Defense, “HIPAA Security Rule Update”, updated September 21, 2026, accessed Oct 2026. ↩

13. Source: OWASP, “OWASP Top 10 API Security Risks – 2023”, accessed Oct 2026. ↩

14. Source: Amazon Web Services, “Penetration Testing”, accessed Oct 2026. ↩

15. Source: OWASP, “Mobile Application Security Verification Standard (MASVS)”, accessed Oct 2026. ↩

16. Source: OWASP, “Web Security Testing Guide” project page, accessed Oct 2026. ↩

17. Source: PTES, “The Penetration Testing Execution Standard” (readthedocs mirror), accessed Oct 2026. The mirror describes itself as an unofficial fork; the official site is pentest-standard.org, which did not load for us. ↩

18. Source: NIST, “SP 800-115, Technical Guide to Information Security Testing and Assessment”, accessed Oct 2026. ↩

19. Source: Cobalt, “Pricing”, accessed Oct 2026. List prices and terms according to the company’s pricing page; the $3,500 autonomous test is described as a limited-time offer ending December 31, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

20. Source: HackerOne, “Bug Bounty Platform”, accessed Oct 2026. HackerOne does not publish program prices. ↩

21. Source: Intruder, “Pricing”, accessed Oct 2026. List price according to the company’s pricing page, excluding VAT. ↩ ↩²

22. Source: Blaze Information Security, “Penetration Testing Cost & Pricing in 2026: Buyer’s Guide”, published May 11, 2026, accessed Oct 2026. Planning ranges from a provider that sells these services. ↩ ↩² ↩³ ↩⁴

23. Source: Synack, “How Much Does a Pentest Cost? 2026 Trends and Insights”, published June 25, 2026, accessed Oct 2026. Ranges from a provider that sells these services. ↩

24. Source: OffSec, “PEN-200: Penetration Testing with Kali Linux (OSCP)”, accessed Oct 2026. ↩

25. Source: CREST, “Accreditation”, accessed Oct 2026. ↩