Many vulnerabilities arise not from exotic attacks but from flaws in your own logic: a missing authorisation check, an API returning more data than needed, a filter forgotten when switching tenants. A penetration test looks for exactly these flaws from an attacker’s perspective.
Delimitation
An automated vulnerability scan finds known issues such as outdated libraries or missing security headers, quickly and cheaply. An audit checks configurations and processes against a standard. A pentest goes further: specialists actively try to exploit and chain vulnerabilities, finding logic flaws no scanner detects. The three complement each other.
Black, grey and white box
In a black-box test the testers have no prior information, like an external attacker. In a grey-box test they receive test accounts with different roles, which is usually most sensible for SaaS, because the most dangerous flaws lie between roles and tenants. In a white-box test they additionally have access to code and architecture, increasing coverage.
What is examined in SaaS
Tenant separation: can a user of customer A access customer B’s data via manipulated identifiers? Permissions within a tenant: can an ordinary user trigger admin functions? Authentication and sessions, including SSO configuration and password reset. APIs and webhooks. File uploads. And with AI features, increasingly prompt injection and data leakage through tools.
When a pentest makes sense
Before launching a product with sensitive data, before closing with enterprise customers who require a report, after major architectural changes and then on a regular cycle. A pentest on a product with obvious basic problems is wasted money, though: first the basics such as row-level security, dependency updates and configuration should be right.
Fixing findings sustainably
A pentest report is a snapshot. Value arises when findings are fixed by severity, the fix is verified and the cause is addressed — for example through an automated test that prevents the flaw in future. A tenant-separation finding is rarely a one-off but a sign of a pattern. Pentests are one of the technical measures data protection law expects as regular testing of effectiveness. Preparation is covered in our pre-launch security checklist.