Customer Requires a Penetration Test? What to Do Next

Quick answer: When a customer requires penetration test evidence before signing or renewing a contract, you need a recent, independent penetration test of the systems that handle their data, usually completed within the last 12 months. Confirm exactly what the customer expects, scope the test around the product or service they use, hire a qualified provider, fix critical findings, and share an attestation letter or executive summary rather than the full technical report.

It often arrives in a security questionnaire, a vendor onboarding portal or an email from procurement: "Please provide your most recent penetration test report." For many growing companies, especially SaaS providers, this is the first time a penetration test becomes urgent. A deal may be waiting, and the clock is running.

This guide explains what to do when a customer requires penetration test results, how to understand the request, how to scope and schedule a test quickly, what to share, how to handle findings and how to stay ready for the next request. To get a test scheduled with experienced testers, explore Privaxi's testing and assessment services.

Why Customers Ask for Penetration Tests

• Vendor risk management: customers must assess the security of suppliers that access their data or systems.

• Their own compliance: frameworks such as SOC 2, ISO 27001, PCI DSS and HIPAA require customers to manage third-party risk.

• Regulatory pressure: financial services, healthcare and public sector buyers face strict supplier rules.

• Cyber insurance: insurers increasingly ask customers how they evaluate vendor security.

• Past incidents: supply chain breaches have made security teams more cautious about new vendors.

Understanding the reason behind the request helps you give the right evidence. In many cases, a customer requires penetration test because their own auditors expect proof that suppliers are tested.

Step 1: Understand Exactly What the Customer Wants

Before booking anything, clarify the request. Asking a few questions can save time and money:

• Which systems or services must be tested: your web application, API, cloud environment or internal network?

• How recent must the test be? Most customers accept tests completed within the last 12 months.

• Do they require an independent third-party tester, or will internal testing do?

• Do they want a full report, an executive summary or an attestation letter?

• Do they need proof that critical and high findings were fixed?

• Are there specific standards they expect, such as OWASP-based application testing?

Get these answers in writing if possible. A clear understanding of why the customer requires penetration test evidence prevents you from testing the wrong systems or delivering the wrong document.

Step 2: Check What You Already Have

You may already have useful evidence. A penetration test completed in the past year, a SOC 2 report that mentions testing, or results from a cloud security review can sometimes satisfy the request. If your last test is older than 12 months, covered a different product or found critical issues that were never fixed, you will likely need a new test. Our guide on whether you need a penetration test can help you decide.

Step 3: Scope the Test Around the Customer's Data

Focus on the systems your customer actually uses. For most SaaS companies, that means:

A focused scope keeps cost and timeline reasonable while answering the customer's real question. For scoping tips, see our guide to penetration testing scope, and for application testing, read about web application penetration testing and SaaS penetration testing.

Step 4: Choose a Qualified, Independent Provider

Most customers expect testing by an independent third party with qualified testers. When a customer requires penetration test report, they often check the provider's credibility, methodology and report quality. Look for:

• Testers with recognized certifications and real application testing experience.

• A documented methodology based on standards such as OWASP and NIST SP 800-115.

• Manual testing, not just automated scanning.

• Clear reports with executive summaries and attestation letters.

• Retesting included after you fix issues.

• Ability to schedule quickly when a deal is waiting.

Our guide to choosing a penetration testing company lists more questions to ask.

Step 5: Plan the Timeline

Tell your customer the expected timeline early. Many buyers are flexible if they see a signed engagement and a clear schedule. For more detail, see our guide on how long a penetration test takes.

Step 6: Fix Critical Findings Before Sharing

Customers care less about whether issues were found and more about whether they were fixed. Prioritize critical and high findings, especially anything affecting authentication, authorization or customer data isolation. Ask your provider to retest those issues and update the report or attestation letter to reflect the fixes. Our guide to penetration testing remediation explains how to organize this work quickly.

Step 7: Share the Right Evidence

Full penetration test reports contain sensitive technical details. Sharing them widely increases risk. Most organizations share one of these instead:

Decide your sharing policy in advance so you can respond consistently whenever a customer requires penetration test evidence. Our guide to the penetration testing report explains what each section contains.

Answering Security Questionnaires About Testing

Questionnaires often include questions such as "How often do you perform penetration testing?", "Who performs it?" and "How are findings remediated?" Prepare standard answers based on your testing program: frequency, independent provider, scope, methodology, remediation timelines and retesting. Keep the answers consistent with your attestation letter and policies. Review these answers every quarter with your security lead so they always reflect current tools, providers and timelines, and store them in a shared library that sales can access. Accurate, consistent answers build trust faster than long ones.

When Customers Ask for Compliance Reports Too

Penetration testing requests often come alongside requests for SOC 2 reports, ISO 27001 certificates or HIPAA documentation. A penetration test supports these frameworks but does not replace them. If a customer asks for both, plan your testing so the results also support your compliance program. See our articles on SOC 2 penetration testing requirements, SOC 2 for enterprise deals and ISO 27001 Annex A 8.8.

How Much Does It Cost?

For a typical SaaS application with an API and cloud environment, cost depends on the number of user roles, endpoints, integrations and environments, plus whether retesting and attestation letters are included. A focused scope built around what the customer needs is usually more affordable than testing everything at once. See our guide to penetration testing cost for typical pricing factors.

Staying Ready for the Next Request

Once one customer requires penetration test evidence, others will follow. Instead of reacting each time, build a simple program:

1. Schedule an annual penetration test of your core product and cloud environment.

2. Add targeted tests after major releases or architecture changes.

3. Keep a current attestation letter and executive summary ready to share.

4. Maintain standard questionnaire answers about testing and remediation.

5. Track remediation and retest results so you can prove fixes quickly.

6. Consider continuous testing for fast-changing products.

Read more in our guides to the annual penetration test and continuous penetration testing.

Turning Security Into a Sales Advantage

A fast, confident response to security reviews shortens sales cycles and builds trust with enterprise buyers. Companies that can share a recent attestation letter, explain their testing program clearly and show remediation discipline often move through procurement faster than competitors. Treat each customer requires penetration test request as a chance to show maturity, not just a hurdle to clear. Sales and security teams should work together on a shared process, so account managers know which documents can be sent immediately and which need approval, and security staff are not pulled into every deal at the last minute. Some companies publish a trust page that summarizes their security practices and lets customers request documents, which saves time for both sides.

Common Mistakes to Avoid

• Sending an automated vulnerability scan when the customer asked for a penetration test.

• Testing a marketing website instead of the product the customer uses.

• Sharing the full technical report without an NDA or redaction.

• Waiting until the deal deadline to start the process.

• Leaving critical findings unfixed before sharing results.

• Giving questionnaire answers that do not match your actual testing practices.

Avoiding these mistakes keeps deals moving and protects your security. For help getting started quickly, a free penetration test can show your external exposure before a full engagement.

What Customers Look for in Your Results

Security reviewers read penetration test evidence quickly and look for a few key signals. They check that the test date is recent, that the scope covers the product they are buying, that an independent and qualified provider performed the work, and that no critical or high findings remain open. They also look for a clear methodology and a named point of contact. If a customer requires penetration test evidence and your attestation letter answers these points on one page, the review usually moves forward without long back-and-forth emails.

If You Cannot Meet the Deadline

Sometimes a deal deadline arrives before testing can be completed. Be honest and proactive. Share a signed statement of work or engagement letter showing the test is booked, explain the planned dates and scope, and offer interim evidence such as recent vulnerability scan summaries, security policies or cloud configuration reviews. Many buyers accept a short delay or a contract clause that requires the test within an agreed period. What damages trust is silence or overstated claims, so keep communication clear until the final report is ready.

Frequently Asked Questions When a Customer Requires a Penetration Test

What should I do if a customer requires a penetration test?

When a customer requires penetration test evidence, confirm what they need, scope the test around the systems that handle their data, hire a qualified independent provider, fix critical findings and share an attestation letter.

How recent does a penetration test need to be for customers?

Most customers expect a penetration test completed within the last 12 months, and some also expect testing after major product changes.

Do I have to share the full penetration test report?

Usually not. Most organizations share an attestation letter or executive summary, and only share redacted or full reports under NDA when necessary.

Will a vulnerability scan satisfy a customer request?

Usually not. Customers asking for a penetration test expect manual testing by qualified testers, not just automated scan results.

How long does it take to get a penetration test for a customer?

Testing for a typical SaaS scope often takes one to three weeks, plus scheduling, reporting, remediation and retesting.

What should the penetration test cover for a SaaS customer?

Typically the customer-facing application, APIs, cloud environment, authentication and multi-tenant data isolation.

Final Thoughts

When a customer requires penetration test evidence, the fastest path is clear: understand the request, scope around the customer's data, use a qualified independent provider, fix critical issues and share an attestation letter. Then build a regular testing program so the next request is easy.

If a customer requires penetration test results and you need help quickly, explore Privaxi's testing and assessment services.