Penetration testing for US SaaS facing a security review.
Manual web application and API testing for US software companies, priced in dollars, with a report set out for SOC 2 auditors, PCI assessors and enterprise vendor-risk teams.
Who asks for testing, and what they want
The reader of a pentest report is rarely the engineer who fixes it. These are the readers we write for in this market.
| Who asks | What they usually look for | What the engagement gives you |
|---|---|---|
| SOC 2 audits | The criteria do not name penetration testing, but auditors commonly look for it as evidence of monitoring and vulnerability management (CC4.1, CC7.1). | Testing evidence your auditor can review, with findings tracked to closure. It is not an attestation. |
| PCI DSS v4.0 | Penetration testing at least once every 12 months and after significant change, including the application layer (requirement 11.4). | Application-layer testing of the in-scope web application and API. Network and segmentation testing are not part of these packages. |
| HIPAA Security Rule | A risk analysis and periodic technical evaluation of safeguards. HHS proposed in January 2025 to require penetration testing at least every 12 months. | Evidence that the application's safeguards were tested. Check the rule's current status with your compliance lead. |
| NYDFS Part 500 | Covered entities must run penetration testing at least annually by a qualified internal or external party (section 500.5). | Documented external testing of the in-scope application for your records. |
| Enterprise vendor-risk reviews | A recent third-party test inside a SIG or CAIQ questionnaire, with scope and remediation status. | A shareable summary and a dated retest record you can attach. |
Not claimed: FedRAMP 3PAO accreditation · PCI QSA or ASV status · HITRUST assessor status. If a contract requires one of these, tell us at scoping.
Prices in US dollars
Starting prices for the three packages. Your quote is fixed after a scoping call.
Compare the packagesFocused test
One web application or one API, before a release or a first customer review.
Product test
A multi-tenant SaaS product and its API, for enterprise reviews and audit evidence.
Release programme
Teams that ship every week and answer security reviews all year.
The hours we share
Our working day ends as yours begins. The hatched block is an evening call window, booked by arrangement.
The practical side
- Invoices in dollars
- Invoices in US dollars come from Zeno Ventures Pvt. Ltd., an Indian company. Prices exclude any taxes.
- Calls in your morning
- There are no shared office hours with the East Coast. Calls are booked by arrangement between 07:30 and 10:30 Eastern, which is our evening.
- Written updates
- During the testing window, progress and any urgent finding reach your named contact in writing, through the route set in the rules of engagement.
- Paperwork before testing
- A statement of work and written authorisation from the system owner come first.
In more detail
What US buyers usually ask for
For most US SaaS companies the pentest is part of a deal or an audit. An enterprise prospect’s vendor-risk team sends a SIG or CAIQ questionnaire. A SOC 2 auditor asks how vulnerabilities in the product are found. A payments customer asks whether the application in PCI scope was tested this year.
Each of those readers wants the same three things from the report: what was tested, how, and whether the findings were fixed. The summary answers them in a page. The detail gives your engineers the request, the response, the affected roles and a specific fix. After the retest, a new version records what is fixed and when that was verified.
SOC 2 does not require a pentest, but auditors ask
The SOC 2 trust services criteria do not name penetration testing. In practice, many auditors look for an independent test as evidence for monitoring and vulnerability management, and many enterprise buyers ask for it regardless of the audit. A test scoped to the systems in your SOC 2 boundary gives your auditor something specific to review.
We will not tell you that a test guarantees an audit outcome. We will scope to what your auditor and your buyers have asked for, and the report will say exactly what was covered.
PCI DSS, HIPAA and NYDFS
PCI DSS v4.0 requirement 11.4 calls for penetration testing at least once every 12 months and after significant change, at both the network and application layers. These packages cover the application layer: the web application and API in scope. Network and segmentation testing are separate work.
Healthcare and financial services have their own rules. The HIPAA Security Rule requires risk analysis and periodic evaluation, and HHS has proposed an explicit annual penetration test. New York’s Part 500 requires covered entities to run penetration testing at least annually. In each case, check the current rule with your compliance lead; we test the application and document what we did.
Working across the time difference
Our working day ends as yours begins on the East Coast. We book calls in your early morning and keep everything else in writing: scope questions, progress during the testing window and any urgent finding, through the route agreed in the rules of engagement. The evening call window is offered by arrangement while we confirm it as a standing commitment.
- Standard payment schedule wording
- Evening call window as a standing commitment
Questions buyers ask
Will this satisfy our SOC 2 auditor?
We cannot promise what an auditor accepts. A pentest gives your auditor testing evidence to review: the scope, the dates, the findings and the retest status. Ask your auditor what they expect before scoping, and we will scope to it.
Does this cover PCI DSS requirement 11.4 in full?
It covers application-layer testing of the in-scope web application and API. Internal and external network testing and segmentation testing are not part of these packages, so plan those separately.
Are you a FedRAMP 3PAO?
No. FedRAMP assessments must be performed by an accredited third-party assessment organisation, and ZenoPentest is not one.
How do calls work across the time difference?
Calls are booked early in your morning, which is our evening, by arrangement. West Coast teams usually prefer written updates with a call when one is needed.
Where is the testing done from?
Zeno Ventures is an Indian company and contracts from India. The people performing the testing are named in your proposal, together with where they work.
Will you work on our MSA and security terms?
Yes, we review your paper. Data-handling terms are agreed before any testing starts; our own standard wording is being finalised.
Start with one product.
Tell us what you are shipping and who needs the report. You get scoping questions, then a fixed quote in your currency.