Penetration Testing for Client Contracts

Read the clause, not the panic

Contractual security clauses are usually copied from a template, and the wording is often broader than the customer's actual concern. "Supplier shall conduct regular penetration testing of all systems" sounds enormous. In practice the reviewer wants assurance about the systems that touch their data.

Send us the clause or the questionnaire. Establishing what is genuinely being asked for is free, takes about half an hour, and frequently reduces the scope and the cost.

What the reviewer is actually checking

Whoever reads your response is usually working through a checklist. They want:

• Independence. Testing by a third party, not your own developers.
• Accreditation. Increasingly specified, and increasingly verified. CREST is the usual named standard.
• Recency. Almost always within the last twelve months.
• Relevant scope. Covering the systems that process their data, not an unrelated corporate network.
• Evidence of remediation. Findings identified is half an answer. Findings closed is the whole one.

The recurring obligation people miss

Most contractual testing clauses are annual, not one-off. Signing means committing to a recurring cost for the life of the agreement, and to producing evidence each year without being chased for it.

Worth budgeting for at signature rather than discovering at the first renewal. Worth also checking whether the clause allows you to share a summary rather than the full technical report — most customers accept one, and it protects detail you would rather not circulate.

What we provide

A full technical report for your team, and where useful a customer-facing summary or letter of attestation you can share without exposing exploitation detail. Retest is included as standard, so you can evidence closure rather than just identification.

If the contract sets a recurring obligation, we will diary it and contact you ahead of the anniversary rather than leaving you to remember.

Be careful buying on price here

This is the situation where cheap testing most often backfires, because the report has to satisfy someone else. A scan presented as a penetration test is usually obvious to a competent security reviewer, and being caught submitting one damages the commercial relationship considerably more than the cost saved.

If the client's reviewer rejects your evidence, you commission a second test under time pressure and pay twice. The cheapest credible option is a properly scoped test from an accredited provider, not the lowest number you can find.

Common questions