A real project comes first
The first conversation is about one client launch, one product review or one portfolio company need. A recurring arrangement is formalised only after the first piece of work shows the fit.
Work alongside us, one project at a time.
ZenoPentest works with agencies, software companies, funds and accelerators that bring security work into projects they already run. Each model below explains how work arrives, who contracts with whom and what has to be agreed before the first engagement. Start with one real opportunity. There are no partner tiers, badges or sign-up forms, and a website enquiry does not create a partnership.
Principles
Responsibilities are written down
Who scopes, contracts, signs the authorisation, holds credentials, talks to the end client, fixes, requests the retest and answers the auditor is recorded in the proposal for every engagement.
Who tested is never hidden
Report attribution is agreed per engagement. When an auditor, client or end customer needs to know who performed the testing, they are told accurately. No arrangement presents the work as delivered by someone who did not deliver it.
Terms are agreed, not advertised
Commercial terms, attribution, insurance and data handling are agreed in writing for each relationship. Nothing on this page is a published rate, margin or commission.
Partnership models
Commercial terms, attribution, insurance and data handling are agreed per relationship. Nothing below is a published rate or tier.
Client-project co-delivery
Best for development, product and web agencies adding a security workstream to a client build, launch or integration.
The agency keeps the client relationship and delivers the build. ZenoPentest delivers a scoped assessment as a defined workstream within the project, with the responsibility split agreed before testing.
How it works
- How work arrives. The agency brings a client project with a trigger: a launch, a security questionnaire, an enterprise review, a new SSO or integration, or reassurance after an incident.
- Contracting. Usually the agency holds the client contract and commissions the security workstream. The system owner, normally the client, signs the testing authorisation directly in every case.
- What we commit to. A written scope and responsibility split before testing, no testing without signed authorisation, serious findings raised to the named contacts during testing, and accurate attribution of who tested.
Responsibilities and terms to agree
- Agency: client contract, environments, test accounts and hosting provider permissions
- Agency: fixing findings and requesting the retest
- Client: signed testing authorisation and distribution of the report to its customers or auditors
- ZenoPentest: scope, testing, evidence, report, readout and retest verification
- All parties: who talks to the client during testing, recorded in the proposal
- To agree: Commercials: how the workstream is priced and invoiced through the agency
- To agree: Attribution: how the report names the testing organisation and whether any co-branded format applies
- To agree: Insurance: liability and insurance cover required by the agency and the client
- To agree: Data handling: how test credentials, evidence and reports are stored, shared and deleted
- To agree: Client contact: who speaks to the client during and after the engagement
- To agree: Retest: number of rounds and the period they cover
Referral
Best for agencies, consultants and advisers who meet a client need but do not want to manage the security work.
The partner introduces a qualified need. The end client and ZenoPentest agree the scope and contract directly. The partner can stay informed to the extent the client agrees.
How it works
- How work arrives. An introduction to a specific client with a defined trigger, a named contact and permission from the client to be introduced.
- Contracting. Direct agreement between the end client and ZenoPentest. The referral relationship and any terms between the partner and ZenoPentest are documented separately.
- What we commit to. The introduction is handled as agreed with the partner, the client knows how the referral works, and the partner receives only the information the client permits.
Responsibilities and terms to agree
- Partner: introduction, context on the system and permission from the client to share it
- Client: contract, authorisation, environments and fixes
- ZenoPentest: scope, testing, reporting and retest verification
- All parties: whether the partner receives updates or the report, agreed with the client
- To agree: Commercials: whether any referral terms apply and on what basis
- To agree: Attribution: how the partner may describe the relationship publicly, if at all
- To agree: Insurance: cover held by the contracting parties
- To agree: Data handling: what the partner may see of the scope, findings and report
- To agree: Introduction handling: what happens if the client was already in contact with ZenoPentest
Subcontract under the agency’s paper
Best for agencies whose client contract requires all delivery to flow through them.
ZenoPentest delivers the assessment as a subcontractor under the agency’s agreement with the client. This is considered case by case and is never presented as the agency’s own testing when the reader needs to know otherwise.
How it works
- How work arrives. The agency asks for delivery under its existing client contract, usually because of procurement rules or a framework agreement.
- Contracting. Subcontract between the agency and ZenoPentest, with flow-down of the relevant client terms. The client still signs the testing authorisation, or confirms in writing that the agency may authorise on its behalf.
- What we commit to. Accepted only when disclosure, report identity and the client’s reviewer requirements are settled first. The report states accurately who tested and who reviewed.
Responsibilities and terms to agree
- Agency: client contract, flow-down terms and client communication as agreed
- Client: authorisation for testing, directly or delegated in writing
- ZenoPentest: testing, evidence, report and retest verification under the agreed scope
- All parties: disclosure of the subcontracted delivery to reviewers who require it
- To agree: Commercials: subcontract price, payment terms and invoicing
- To agree: Attribution: report identity, and how delivery is disclosed to the client’s auditor or customer
- To agree: Insurance: liability caps and insurance cover flowing down from the client contract
- To agree: Data handling: storage, access and deletion obligations flowing down from the client contract
- To agree: Client contact: whether ZenoPentest may speak to the client directly
Software ecosystem or marketplace partner
Best for platforms, developer-tool vendors and product companies whose customers or implementation partners regularly need application testing.
The software company points its customers or ecosystem partners to scoped security work. Each customer engagement is scoped and contracted on its own. No native integration, marketplace listing or endorsement is implied until one exists.
How it works
- How work arrives. Customers of the platform, or apps built on it, ask the vendor for testing help before a launch, a marketplace review or a customer security review.
- Contracting. Usually a direct agreement with each customer, with a separate document between the vendor and ZenoPentest covering referrals, customer ownership and any technical integration.
- What we commit to. Each customer gets its own scope and authorisation. A customer’s findings are not shared with the vendor without that customer’s written permission.
Responsibilities and terms to agree
- Vendor: introductions and context on the platform’s security model
- Customer: contract, authorisation, environments and fixes
- ZenoPentest: scope, testing, reporting and retest verification per customer
- All parties: what, if anything, the vendor learns about a customer’s findings
- To agree: Commercials: any referral or programme terms between the vendor and ZenoPentest
- To agree: Attribution: how the vendor may describe the relationship and whether its name appears in reports
- To agree: Insurance: cover held for customer engagements
- To agree: Data handling: whether findings affecting the vendor’s platform itself are reported to the vendor, and how
- To agree: Customer ownership: who the customer relationship belongs to after the engagement
Portfolio support for funds and accelerators
Best for vC funds, platform teams and accelerator programmes supporting portfolio companies with launches, enterprise reviews and AI features.
The fund or accelerator introduces portfolio companies to scoped security work. Each company commissions and owns its own engagement unless the fund agrees to fund a defined programme. Pre-investment diligence is a separate route.
How it works
- How work arrives. A portfolio or platform lead introduces a company with a current need, or proposes a small, defined support initiative for several companies.
- Contracting. Usually a direct agreement with each portfolio company. Where the fund pays, the payer, the recipients of results and the scope are written into a separate agreement.
- What we commit to. Detailed findings go to the company that was tested. The fund receives only what each company has agreed in writing to share.
Responsibilities and terms to agree
- Fund: introductions, and funding where agreed
- Portfolio company: contract or acceptance, authorisation, environments and fixes
- ZenoPentest: scope, testing, reporting and retest verification per company
- All parties: what the fund may see, agreed with each company in advance
- To agree: Commercials: who pays, per company or for a defined programme
- To agree: Attribution: whether and how the fund may refer to the support it offers
- To agree: Insurance: cover held for each company engagement
- To agree: Data handling: what summary information, if any, is shared with the fund
- To agree: Conflicts: how follow-on remediation or diligence roles are disclosed
Questions buyers ask
Is there a standard commission or reseller margin?
No. Commercial terms are agreed for each relationship and contracting model before the first opportunity proceeds. None are published because none have been standardised.
Do we have to commit to a volume of work?
No. Start with one concrete opportunity. Any recurring arrangement needs a defined, sustained need and a written agreement.
Can you deliver under our brand?
Report attribution is agreed per engagement. We will not hide who performed the testing from an auditor, client or end customer who needs to know. Any co-branded format is still to be confirmed.
Will you take over our client relationship?
How future contact with your client is handled is agreed in writing before the engagement. Raise it in the first conversation so it goes into the agreement.
Which model should we start with?
If you hold the client contract and want the work inside your project, co-delivery. If you would rather hand the need over, referral. Subcontracting is considered when a client contract requires it.
Can we say we are a ZenoPentest partner?
Only once a relationship is agreed and the wording approved. Brand use, public references and logo use need explicit agreement. An enquiry does not establish a partnership.
Who signs the testing authorisation in a partner engagement?
The system owner, in every model. An agency or fund cannot authorise testing of a system it does not own unless the owner delegates that in writing.
What should the first conversation cover?
The opportunity, your preferred model and client experience, the deadline, the reviewer’s requirements and who will fix findings. Do not send credentials or client documents in the enquiry.
Start with one useful opportunity.
A client project, a product need or a portfolio introduction is enough to begin.