Pass the
Enterprise Security Review

Realistically yes, the moment you start selling into mid-market or enterprise. The first dozen enterprise security questionnaires you receive will ask for a recent independent penetration test, a SOC 2 Type 1 (heading toward Type 2) and evidence of a vulnerability management programme. Founders who postpone the work until their first enterprise procurement cycle typically lose three-to-six weeks of sales motion to remediation. A right-sized ASVS L2 engagement against the production app is usually the cheapest unblock at that stage.

OWASP ASVS L1 is a generic baseline ("opportunistic attacker who applies known and easily exploitable vulnerabilities") and rarely satisfies an enterprise buyer's security review. L3 is reserved for systems where compromise has serious consequences (financial transactions, healthcare, military) and adds controls that are expensive to retrofit. L2 is the sweet spot for SaaS — it covers the controls a competent attacker with knowledge of the application and reasonable resources would attempt, including business-logic abuse, multi-tenant boundary testing, and authentication / authorisation depth that customer questionnaires keep asking about.

The relevant Trust Services Criteria are mostly under the Security category — CC6 logical and physical access, CC7 system operations and change management, CC8 risk mitigation. From a pentest perspective the auditor cares about CC7.1 (vulnerability identification), CC7.2 (anomaly monitoring), CC8.1 (change management before production deployment) and the supporting evidence: a documented testing programme, a tested cadence (typically annual external pentest plus continuous internal scanning), tracked remediation, and a retest verifying the closure. AxVeil reports include the SOC 2 control mapping appendix and a Letter of Attestation that drops cleanly into the auditor's evidence request.

Mapped to the OWASP API Security Top 10 (2023). BOLA / BFLA tenant-boundary enumeration is the dominant risk class for B2B SaaS — most multi-tenant breaches in the public record trace back to broken object-level or function-level authorisation rather than injection or exposure. GraphQL adds introspection abuse, query depth and alias-based denial of service, batched mutation abuse and complex authorisation modelling. We exercise the schema (where OpenAPI / Swagger / Protobuf / GraphQL SDL is available) and discover endpoints black-box where it is not.

Yes. AWS, Azure and GCP control-plane review against the CIS Benchmarks. IAM privilege-escalation pathing, role assumption chains, public S3 / Blob / GCS exposure, Lambda / Function trigger abuse, secrets-manager misuse, Kubernetes RBAC and admission-controller bypass. MITRE ATT&CK Cloud matrix is used to structure the cloud findings. For SaaS running on managed Kubernetes (EKS / AKS / GKE) we also test cluster-level RBAC and pod-security boundaries.

Four-to-six weeks of testing for a single production web application plus its API plus the supporting cloud account. Two-to-three weeks for the app + API alone if the cloud is out of scope. Add one week for mobile (iOS or Android) per platform. Add two weeks for a credential-phishing / business-email-compromise tabletop where required by the buyer. Reporting and remediation runs in parallel; free retest within 30 days of the original report is included.