Security for SaaS

Penetration testing & security for SaaS

For a SaaS business, security is a sales gate: prospects ask for your SOC 2 and your pentest before they sign. We test multi-tenant isolation, the web app and its APIs, and the cloud it runs on, and combine the testing with the readiness work that prepares you for the audit. Manual-first, under NDA, with a free re-test within the window set in the SoW.

Sector risk

What's at stake in SaaS

The defining SaaS risk is tenant isolation: in a shared platform, the worst-case bug lets one customer reach another's data. Alongside it sit the web, API and cloud-configuration issues that decide whether your platform is trustworthy.

Tenant isolation

Cross-tenant IDOR/BOLA, where one customer reads or changes another's data. It is the most damaging multi-tenant flaw.

Authorisation across roles

Broken function- and object-level authorisation between admin, member and viewer roles. Only multi-role testing finds it.

Cloud misconfiguration

Over-permissive IAM, public storage and weak logging. Most cloud risk sits in configuration, where it can't be seen from the outside.

The SOC 2 sales gate

Without SOC 2 readiness and a credible pentest, enterprise deals stall, because procurement usually asks for both before signing.

How we test

How we test SaaS platforms

We focus on what makes or breaks a SaaS platform: the web app, the multi-tenant API tested across roles and tenants, the cloud configuration it runs on, and SOC 2 readiness so the testing turns into evidence your buyers accept.

Web application penetration testing

Manual-first testing mapped to OWASP WSTG and verified against ASVS. It targets the business-logic and access-control flaws that scanners don't catch.

Explore this service

API penetration testing

Authenticated, multi-role testing of REST and GraphQL APIs for BOLA, BFLA and object-property authorisation flaws, mapped to the OWASP API Top 10 (2023).

Explore this service

Cloud security assessment

A review of your AWS, Azure or GCP configuration (identity, storage, network and logging) against the CIS Benchmarks, as part of our security audit.

Explore this service

SOC 2 readiness & audit support

Human-led SOC 2 gap assessment, remediation and audit support against the Trust Services Criteria, plus the pentest evidence. Readiness, not the attestation.

Explore this service

Standards & regulations

Grounded in the standards SaaS buyers check

OWASP WSTG v4.2OWASP API Top 10 (2023)OWASP ASVS 5.0AICPA TSC (SOC 2)CIS BenchmarksCVSS 3.1

Application and API testing maps to OWASP WSTG v4.2, the OWASP API Security Top 10 (2023) and OWASP ASVS 5.0; cloud configuration is reviewed against the CIS Benchmarks; SOC 2 readiness maps to the AICPA Trust Services Criteria. We provide readiness, gap assessment and the supporting pentest. The SOC 2 report is issued by an independent CPA firm, not by us. Findings are scored with CVSS 3.1.

Why Vexaro

What you can expect on a SaaS engagement

Vexaro builds products and infrastructure as well as testing them. That inside view is why we look hard at multi-tenant logic and write reports your engineers can act on. We name no clients.

What you can expect

Manual-first testing of the web app, its APIs and tenant isolation
Multi-role, multi-tenant testing that surfaces isolation flaws
SOC 2 readiness plus the pentest evidence your buyers ask for
Reports your engineers can act on, with a free re-test of the fixes within the window set in the SoW
NDA before any access; evidence encrypted, then deleted or returned

Secure your SaaS platform.

Tell us about your platform, your tenancy model and your compliance goals. We'll scope the right engagement, agree the rules with you and deliver the report under NDA. The first consultation is free.