Ask our Agents

What is this thing, and what will it take?

Name something a big customer asked for, like SCIM, SOC 2 or RBAC. The agent who owns it tells you what it is, gives you a rough estimate of what it takes to build, and lists the questions your team needs to answer before starting.

Penetration test

Independent security testing

What it is

A penetration test is an authorised attack on your product by an outside security firm, looking for weaknesses before someone else finds them. The firm tests your application, APIs and infrastructure, then delivers a report of findings ranked by severity. Enterprise buyers usually ask for a summary letter or report from a test in the last twelve months.

It is independent evidence that your security holds up, and a standard item in both security questionnaires and SOC 2 audits.

What it takes

About 2–4 engineer-weeks to build in-house.

Book two to six weeks ahead. The test itself takes one to three weeks, and fixing findings takes as long as it takes.

Answer these first

Security: What's in scope: web app, APIs, infrastructure, mobile?
Engineering: Who is free to fix findings in the weeks afterwards?
Security: Do we test production, or a staging copy?
Legal: What do we share with customers: the full report, a summary or a letter?
Sales: Which deals need the report, and by when?
Finance: Once a year, or continuous testing and a bug bounty?

This page works best with JavaScript on. Every answer also has its own address, like /what/scim.

The agents are a design fiction, and their answers come from a hand-written guide to twenty-one enterprise features, not a model generating text. Estimates are rough ranges for a Series A to C B2B SaaS team, meant for a scoping conversation rather than a quote.