Penetration Testing
SaaS Pentest: Penetration Testing That Proves One Tenant Can Never See Another. Report in 14 Days, Free Retest.
A multi-tenant platform shares one codebase, one database and one admin console across every customer, so a single missed tenant filter exposes all of them at once.
Our SaaS pentest is scoped around the six trust boundaries that hold your customers apart: tenant isolation at every data layer, roles inside a tenant, SSO and SAML/OIDC handling, API keys and webhooks, admin impersonation tooling, and billing, export and backup logic. Every finding is a proven path with its customer-facing consequence, mapped to the SOC 2 criterion, ISO 27001 control or HIPAA section your auditor will cite. Fixed price, report in 14 days, free retest.
- Cross-tenant paths proven end to end between test tenants we create and own
- Findings mapped to the SOC 2 criterion, ISO 27001 control or HIPAA section an auditor cites
- Written rules of engagement: test tenants only, agreed windows, a stop condition
Senior-led testing scoped to the way a SaaS platform is actually built: one codebase, shared data stores, per-tenant configuration and the integrations around them.
SEE THE DELIVERABLE
See what a useful
penetration test report looks like.
Review a combined engagement covering web, REST and GraphQL APIs, gRPC, SaaS tenant isolation, Android and iOS, networks, cloud, identity and CI/CD. Includes technical evidence, remediation and retest criteria.
62 pages. 24 findings. 14 charts, diagrams and matrices.
Illustrative penetration test. The organisation, systems and findings are fictional.
Get the sample report
A free PDF. Enter your email and company name, and we’ll email you a download link.
DEFINE YOUR SCOPE
Turn your testing requirements into a clear RFP.
Build one request for your applications, APIs, networks, and cloud. Review the scope, download your document, and send a copy to your inbox and our team.
REQUEST RECEIVED
Your RFP is submitted.
Reference: . Email copies are being sent to and Alexander at Atlant Security. Check your spam folder if needed.
You can also book a call to discuss the scope.
Leads every SaaS pentest personally, runs the remediation workshop with your engineers and signs the attestation letter your auditor and enterprise customers read.
Connect on LinkedIn01 / THE DETAIL
What a SaaS Pentest Actually Tests
A generic penetration test scopes by technology: one web app, one API. A SaaS pentest scopes by trust boundary, because that is how customers are kept apart and how they end up exposed to each other.
Tenant isolation at every layer
The tenant filter has to hold in the request handler and everywhere else data is read: storage paths, the search index, exports, scheduled reports, background jobs and the cache.
Roles and permissions inside a tenant
Member, admin and owner, plus the custom roles enterprise plans add. Whether an invitation flow, a role change or an endpoint missing from the interface lets a member act as an owner.
SSO, SAML and OIDC handling
What your service-provider side accepts: assertion signatures, audience and replay checks, just-in-time provisioning, account linking by email, and the domain claims that decide which tenant a login lands in.
API keys, integration tokens and webhooks
The credentials your customers paste into integration platforms and CI pipelines: scope, lifetime, rotation and what one leaked key reaches. Webhook signatures, and the URLs your platform is told to call.
Admin impersonation and support tooling
The internal console that can log in as any customer. Who can reach it, what second factor protects it, whether every impersonation is audited, and whether a customer-side request can trigger it.
Billing, plan limits, exports and backups
Plan gating the server enforces, trial and downgrade logic, seat counts, the export job that packages a whole tenant, and who can read the backups that hold every tenant at once.
02 / THE DETAIL
The Attack Paths That Repeat in SaaS Platforms
These are the findings that recur across the multi-tenant platforms we assess. Most of them pass a vulnerability scan untouched, because nothing is unpatched; the weakness is in which tenant can reach what.
A tenant identifier the client controls
The tenant ID travels in a header, a query string or a token claim the browser can edit, and the data layer filters on whatever arrives. One changed number returns another customer’s rows.
Isolation that holds at the API and fails in the export job
Request handlers filter by tenant. The CSV export, the search index rebuild, the scheduled report and the email digest each read the database through their own code, and one of them forgets the filter.
Owner-only actions hidden in the interface alone
The button is missing for members. The endpoint behind it accepts the call, so any member can change the billing contact, remove the owner or export the tenant.
SAML and OIDC accepted on trust
A signature checked on the wrong element, an audience check that is missing, and just-in-time provisioning that joins an identity-provider user to an existing account by email address alone.
Integration tokens with the platform’s own permissions
Long-lived API keys without scope, a bearer token embedded in a webhook URL, and one internal service token shared by every microservice. Any one of them leaks, and the leak is platform-wide.
Support impersonation reachable from the customer side
Log-in-as-customer relies on a flag in the session or a parameter in the request, the admin console shares the production domain, and its second factor is weaker than the one on customer accounts.
03 / THE DETAIL
What the Report Has to Prove, and to Whom
A SaaS pentest report has three readers. Your engineers want reproduction steps and a fix. Your SOC 2 or ISO 27001 auditor wants evidence that the platform was tested independently and the findings closed. Your enterprise customer’s vendor-risk team wants a dated letter for the questionnaire. Most reports serve the first reader and leave the other two to reconstruct the evidence.
Ours carries all three. Every finding is mapped to the SOC 2 criterion, ISO/IEC 27001:2022 Annex A control, HIPAA Security Rule section or GDPR article it bears on, the executive summary fits on one page, and the retest record and attestation letter close the loop for the audit file.
Where the platform stores, processes or transmits card data, PCI DSS v4.0 Requirement 11.4 adds internal and external testing at least every twelve months and after significant changes. The surrounding programme is covered on the SOC 2 readiness, ISO 27001 readiness, HIPAA and NIS2 pages.
04 / THE DETAIL
Rules of Engagement for Live Multi-Tenant Platforms
Testing a multi-tenant platform in production is a governance exercise as much as a technical one, because every other customer shares the same stack. Both sides sign rules your largest customer could read.
- Only tenants we own. Cross-tenant paths are proven between test tenants we create. A path that would land in a real customer’s tenant is demonstrated against our own second tenant and stopped there.
- Availability protected. Denial-of-service techniques are excluded, rate-limit tests are capped at agreed thresholds, and anything touching shared job queues or caches runs in an agreed window.
- A named contact and a stop condition. One escalation contact on each side, reachable throughout, a same-day call on any critical finding, and a written condition under which testing halts immediately.
- Evidence handling. Any real customer data encountered by accident is redacted at capture, held encrypted for the engagement only, and destroyed on a documented date.
- Cloud and vendor boundary respected. Testing stays inside the AWS customer penetration testing policy, the Azure penetration testing rules of engagement or the Google Cloud acceptable use policy. Your identity provider and payment processor are tested at the integration surface only.
05 / THE DETAIL
How the Engagement Runs
Five steps, fixed price agreed at the first one, report inside fourteen days of the third.
Scoping call
Your tenancy model, roles, identity providers and integrations, and the audit or questionnaire the report has to satisfy. Fixed price and timeline in writing within 24 hours.
Rules of engagement
Test tenants, staging or production, testing windows, escalation contacts on both sides, the cloud provider’s testing policy, and a written stop condition.
Manual testing
Senior-led, every data path tested from several tenants and roles at once. Tools for breadth, people for the authorisation logic that decides who sees what.
Report and workshop
Findings register with reproduction steps, executive summary mapped to SOC 2, ISO 27001 and HIPAA, and a live remediation session with your engineers.
Retest and attestation
Free retest after you fix, then an attestation letter signed by a named qualified individual, ready for the audit file and the next questionnaire.
06 / PRICING
SaaS Pentest Pricing
Each scope is a fixed price. The platform scope covers the six boundaries above; the rows beneath it combine with it in one proposal with volume pricing, and you approve the total before anything starts.
| Scope | What is covered | Testing | Price |
|---|---|---|---|
| SaaS multi-tenant platform | Tenant isolation, roles, SSO, keys and webhooks, admin tooling, billing and exports | 10-14 days | From $6,000 |
| API, up to 50 endpoints | A public or partner API tested on its own, authorisation-focused | 5-7 days | From $4,000 |
| Separate web application | One additional application such as a standalone admin or partner portal, all roles | 7-10 days | From $5,000 |
| Cloud infrastructure | The AWS, Azure or GCP account the platform runs in: IAM, storage, secrets, network | 7-10 days | From $6,000 |
| Mobile companion app | iOS or Android plus its API | 10-14 days | From $6,000 |
| External perimeter | Internet-facing IP ranges, DNS, mail, remote access | 5-7 days | From $4,000 |
Every scope includes the findings register, the executive summary with SOC 2, ISO 27001 and HIPAA mapping, the remediation workshop, a free retest and the attestation letter. Ongoing security leadership for the platform is described on the SaaS virtual CISO page.
For small projects and ad-hoc work outside our pre-agreed packages or retainers, our standard hourly rate is $460.
07 / THE DETAIL
SaaS Pentest or Vulnerability Scan
Two controls that get bought as if they were one. Your auditor reads them differently, and so does the buyer whose questionnaire has a line for each.
A scheduled scan still belongs between annual pentests; the vulnerability assessment page describes how we run it.
08 / THE DETAIL
Who Commissions a SaaS Pentest
09 / THE DETAIL
Find Out What a Free Trial Tenant Can Reach
One scoping call. Bring your architecture diagram, your last pentest report, the questionnaire holding up a deal, or nothing at all. You leave with a scope written as questions, a fixed price and a report date.
Scope My SaaS Pentest10 / THE DETAIL
Book the Scoping Call
Choose a time for your scoping call.
11 / FAQ
SaaS Pentest FAQ
What is a SaaS pentest?
How do you test tenant isolation?
Do you test in production or staging?
How much does a SaaS pentest cost?
How long does a SaaS pentest take?
Will the report satisfy our SOC 2 auditor?
Do you test SSO, SAML and OIDC?
Do you test the CI/CD pipeline and cloud infrastructure?
What happens if you find a critical vulnerability during testing?
What do we give an enterprise customer who asks for our pentest?
12 / THE DETAIL
Related Services
Penetration testing - Network pentest - DORA TLPT - API pentest - Web app pentest - Cloud pentest - Mobile app pentest - SOC 2 compliance - ISO 27001 readiness - HIPAA compliance - SaaS virtual CISO - continuous AI penetration testing with Pentestas