What pentest does your startup actually need?

Most startup founders know they should get a pentest. Fewer know what kind, what scope, or what a reasonable price looks like and the industry hasn't made this easy to figure out.

Pricing is rarely published. Scope conversations happen after you've already given your email to a sales rep. And the word "pentest" gets used to describe everything from a lightweight automated scan to a two-week manual engagement by a team of three.

This guide gives you a framework to self-assess what you actually need, based on where your company is and what you're building.

The variables that actually determine what you need

There are four factors that map pretty cleanly to pentest scope and cost:

1. Company stage
Pre-seed and seed companies usually need a lighter engagement — enough to surface critical vulnerabilities and satisfy early security questionnaires, but not a full-blown compliance audit. Series A and beyond typically have more surface area, more integrations, and investors or enterprise customers who want to see a proper report.

2. What you're building
A web app with an authenticated user section is a different scope than an API serving third-party developers, which is different again from infrastructure with cloud components and CI/CD pipelines. Each surface has different attack vectors and different testing methodologies.

3. Compliance requirements
SOC 2 Type II, ISO 27001, and PCI DSS all have specific pentest requirements. If you're pursuing any of these, the pentest needs to meet certain criteria — scope, methodology, report format — that go beyond a general security assessment. This is often the trigger that moves a startup from "we should probably do this at some point" to "we need this done in the next 90 days."

4. Scope
This is the one founders underestimate most. Scope drives cost more than anything else. A focused test on your main web application is a very different engagement from one that covers the application, your API, your admin panel, your cloud configuration, and your internal tooling.

The main pentest types and when you need them

1. Web application pentest
The most common for early-stage SaaS. Tests your application from the perspective of an authenticated user, an unauthenticated attacker, and sometimes a privileged user. Covers OWASP Top 10 and beyond — auth flows, access controls, injection points, business logic flaws.
→ When you need it: You have a product with user accounts. A customer asked for a pentest report. You're starting a SOC 2 process.

2. API pentest
Similar to a web application test but focused on your API endpoints. Critical if your API is externally facing or consumed by third-party developers. Auth, rate limiting, data exposure, BOLA/IDOR vulnerabilities.
→ When you need it: Your API is your product or a significant part of it. You have developer customers. You're building in a regulated space.

3. Cloud / infrastructure pentest
Tests your cloud environment — misconfigurations, overly permissive IAM roles, exposed storage buckets, network segmentation issues. Usually AWS, GCP, or Azure.
→ When you need it: You've scaled beyond a simple Heroku deploy. You have infrastructure engineers managing cloud resources. ISO 27001 or SOC 2 is on the roadmap.

4. Combined / full-scope engagement
All of the above, sometimes with internal network or social engineering components. More common at Series B+ or when enterprise contracts require it.
→ When you need it: You're selling to enterprise. Your compliance framework requires broad scope. You've had a security incident and want comprehensive coverage.

A quick self-assessment
Answer these honestly and you'll have a good starting point:

-Stage: Are you pre-product-market-fit, or do you have paying customers and scaling infrastructure?

• Surface area: What are the components you're worried about? Web app only? API too? Cloud infra?
• Driver: Is this proactive, or is a customer / investor / compliance requirement pushing you to do it now?
• Timeline: Do you have a deadline (audit, enterprise deal, fundraise)?
• Budget range: Are you looking for something under €5k, €5–15k, or are you budgeting for a larger engagement?

The combination of these five answers will tell you whether you need a focused lightweight test, a standard web + API engagement, or a more comprehensive scope.

Skip the guesswork
We built a 5-question quiz that maps your answers to a recommended tier and a starting price.
→ Takes under a minute.

faultlinesec.com/quiz

It asks for your work email before showing the result [full transparency on that] and you'll hear from us. But the recommendation is genuine and accurate enough to use as a starting point for any vendor you end up going with, not just us.