What does a SaaS penetration test cover?

A Sherlock Forensics SaaS penetration test covers multi-tenant data isolation, API security and endpoint enumeration, authentication and authorization flows, payment processing security, session management, input validation and injection testing, file upload and storage security and third-party integration security. Standard SaaS pentests start at $5,000 CAD.

How often should a SaaS company get a pentest?

At minimum, annually. Many compliance frameworks including SOC 2 require annual penetration tests. Sherlock Forensics recommends additional testing after major feature releases, infrastructure changes or before enterprise customer onboarding. Annual SaaS pentests from $5,000 CAD.

Do we need a pentest for SOC 2?

SOC 2 Type II audits require evidence of regular security testing as part of the Common Criteria. While penetration testing is not explicitly mandated by the Trust Services Criteria, it is the standard evidence auditors accept for the security testing requirement. A Sherlock Forensics pentest report is formatted for SOC 2 auditor review. Standard pentests from $5,000 CAD.

What is multi-tenant security testing?

Multi-tenant security testing verifies that one customer's data cannot be accessed by another customer in a shared infrastructure environment. Sherlock Forensics tests for tenant isolation at the database level, API level, file storage level and caching layer. This includes testing for IDOR vulnerabilities, shared resource leakage, cross-tenant API access and session confusion. SaaS pentests from $5,000 CAD.

SaaS Security

Penetration Testing for SaaS Companies

Your SaaS handles customer data. A breach is not just your problem. It is your customers' problem.

Sherlock Forensics provides penetration testing for SaaS companies covering multi-tenant security, API testing, authentication and authorization, data isolation and payment security. Reports are formatted for SOC 2 and ISO 27001 compliance. Over 20 years of certified security experience. Standard SaaS pentests from $5,000 CAD. Contact 604.229.1994.

Your customers trust you with their data. Their customers trust them. A vulnerability in your SaaS does not just expose your database. It exposes every organization that relies on your platform. Multi-tenant architectures multiply the blast radius of every security flaw.

Order a SaaS Pentest - $5,000 Scope Your Assessment

Scope

What We Test in a SaaS Pentest

01 - Tenant

Multi-Tenant Security

The defining risk of SaaS architecture. We test whether Tenant A can access Tenant B's data through API manipulation, direct object reference attacks, shared caching layers, file storage enumeration and database query manipulation. One tenant isolation failure exposes every customer on your platform.

02 - API

API Security

SaaS products live and die by their APIs. We enumerate every endpoint, test authentication requirements on each one, check rate limiting, validate input handling and test for mass assignment vulnerabilities. We look for undocumented endpoints, deprecated but still-active routes and API versioning that exposes older, less secure implementations.

03 - Auth

Authentication and Authorization

Login flows, session management, token handling, password reset processes, MFA implementation and OAuth integrations. We test for privilege escalation from regular user to admin, horizontal access between users at the same privilege level and vertical access from one role to another. Every permission boundary in your application gets tested.

04 - Data

Data Isolation

Beyond tenant isolation at the API level, we test data isolation at the database layer, file storage system, message queues, background job processors and caching infrastructure. Shared infrastructure creates shared risk. We verify that the boundaries hold under adversarial conditions.

05 - Pay

Payment Security

Stripe, Paddle, Chargebee and other payment integrations introduce specific attack surfaces. We test webhook validation, subscription manipulation, price tampering, coupon abuse, trial exploitation and the handling of payment-related secrets. PCI DSS compliance depends on getting these integrations right.

06 - Int

Third-Party Integrations

OAuth connections, webhook receivers, API key management for external services, SSO implementations and data sync pipelines. Each integration point is a potential entry vector. We test the security of every external connection your SaaS maintains.

Compliance

Reports That Satisfy Auditors and Customers

SOC 2 Type II

SOC 2 audits require evidence of regular security testing. Our pentest reports are formatted for SOC 2 auditor review with findings mapped to Trust Services Criteria. We include the executive summary, technical findings, risk ratings and remediation evidence your auditor expects.

ISO 27001

ISO 27001 Annex A requires regular technical vulnerability assessments. Our reports map findings to ISO 27001 control objectives and provide the documentation required for certification and surveillance audits. Annual pentests maintain your certification status.

Customer Security Questionnaires

When your enterprise prospect sends a 200-question security questionnaire, having a current pentest report answers the hardest questions immediately. "When was your last penetration test?" and "What were the findings?" become easy answers instead of blockers. A pentest report from Sherlock Forensics closes deals faster.

Enterprise Sales

Close Enterprise Deals Faster

Security Review Is the Bottleneck: Enterprise procurement includes a security review phase that can stall deals for weeks or months. The prospect's security team evaluates your application, infrastructure and security practices. A current pentest report from a qualified firm shortens this process from months to days. The security team reviews your report instead of conducting their own assessment.
Security Questionnaire Ready: SIG, CAIQ, VSA and custom security questionnaires all ask about penetration testing. With a Sherlock Forensics report, you have specific dates, methodologies, findings and remediation timelines ready to cite. No more scrambling to answer security questions you do not have data for.
Competitive Advantage: If your competitor cannot produce a pentest report and you can, you win the deal. Enterprise buyers choose the vendor that reduces their risk. A documented security assessment is the clearest signal that you take their data seriously.

Engagement Options

SaaS Pentest Tiers

Quick Audit - $1,500 CAD: Focused review for early-stage SaaS. Covers authentication, authorization, injection, secrets and API security. Ideal for pre-launch or pre-fundraising. 3-5 business days.
Standard SaaS Pentest - $5,000 CAD: Full penetration test with multi-tenant isolation testing, comprehensive API security review, source code analysis, payment integration testing and compliance-ready reporting. 10-15 business days. Includes re-test after remediation.
Comprehensive Assessment - $12,000+ CAD: Multi-application assessment covering your full SaaS platform, infrastructure, CI/CD pipeline and third-party integrations. Custom-scoped for complex architectures with multiple services, APIs and deployment environments. 3-4 weeks.

Frequently Asked Questions

SaaS Pentest FAQs

What does a SaaS penetration test cover?: Multi-tenant data isolation, API security and endpoint enumeration, authentication and authorization flows, payment processing security, session management, injection testing, file upload security and third-party integration security. Every test is scoped to your specific architecture.
How often should a SaaS company get a pentest?: Annually at minimum. SOC 2 and ISO 27001 require regular testing. We recommend additional testing after major releases, infrastructure changes or before onboarding enterprise customers. Many SaaS companies on annual contracts schedule their pentest to complete before renewal season.
Do we need a pentest for SOC 2?: While not explicitly mandated by Trust Services Criteria, penetration testing is the standard evidence SOC 2 auditors accept for the security testing requirement. Our reports are formatted for SOC 2 auditor review with findings mapped to the relevant criteria.
What is multi-tenant security testing?: Verification that one customer's data cannot be accessed by another customer in a shared infrastructure. We test isolation at the database level, API level, file storage, caching and background processing layers. This includes IDOR testing, shared resource leakage analysis and cross-tenant API access attempts.

Your enterprise prospects are waiting for your pentest report.

Standard SaaS pentests from $5,000 CAD. Compliance-ready reports. Re-test included.

Order Online

Scope Your SaaS Pentest

Tell us about your platform architecture, user base, compliance requirements and timeline. We will scope an assessment that covers your specific risk surface.

Call 604.229.1994

Phone: 604.229.1994
Burnaby Office: Burnaby, BC, Canada
Coquitlam Office: Coquitlam, BC, Canada
Standard Pentest Timeline: 10-15 business days from engagement start