Customer asked for a pen test report and we don't have one

If a customer's security review asks for your penetration test report and you have never had one, say so plainly. Then send what you do have: recent scan results, a short security overview, your policies, and the date of a third-party test if you've booked one. Don't tick "yes," don't present an automated scan as a pen test, and don't go quiet hoping the question goes away.

Reviewers see small vendors without a report all the time. A vendor who overstates its testing and gets caught worries them far more. They need enough evidence to record a risk decision. Sometimes that means you commission a test before the contract is signed; often a dated commitment plus some evidence you already have is enough for now.

What is the questionnaire actually asking?

Read the exact wording first, because it tells you how strict the reviewer will be. Three public examples:

The CSA CAIQ v4, question TVM-06.1: "Are processes, procedures, and technical measures defined, implemented, and evaluated for periodic, independent, third-party penetration testing?" (wording as it appears in AWS's published CAIQ). It asks about a process for periodic, independent testing, so a single report only partly answers it.
Google's open-source VSAQ (infrastructure questionnaire) asks: "Does an independent third party regularly perform penetration tests on all systems used to provide services to customers?" Follow-up questions cover scope, whether the tests include manual testing, which companies did the three most recent tests, how often tests happen, and "Are you willing to share a management summary of the most recent penetration testing reports?"
The same CAIQ also asks (A&A-02.1) whether "independent audit and assurance assessments [are] conducted according to relevant standards at least annually."

The words that keep coming back are independent, third-party, periodic and scope. To a reviewer, "independent third party" means someone outside your company who tests for a living. A scan you ran yourself won't meet that, however careful you were.

"We haven't done any third-party pen testing." What do I write?

Write exactly that, then add context. For example:

We have not yet had an independent third-party penetration test. Today we run [weekly automated dependency and container scanning / a ZAP baseline scan on each release], our hosting runs on [provider], whose own controls are covered by its SOC 2 report, and access to production is limited to [n] people with MFA. We plan a third-party application test in [month], scoped to [the app and API you will use], and will share the summary with you when it is complete.

Keep only the bracketed parts that are true. If you haven't planned a test, leave the date out instead of making one up. An honest "no" with a plan usually gets logged as a finding with a due date. A "yes" you can't back up can come back later as a contract dispute.

What can I send instead of a pen test report?

None of this replaces a test, but it shows the reviewer you check your own systems. Things worth attaching:

Automated scan output, labelled as automated. The OWASP ZAP baseline scan is free; it spiders the site and runs passive checks without attacking anything (ZAP docs):
```
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://app.example.com
```
Run it only against systems you own. Fix what it reports and send the clean rerun with its date.
The dependency and code scanning you already run in CI, such as GitHub Dependabot alerts, along with how fast you patch.
A two-page security overview covering architecture, where data lives, encryption, who has production access, and how you handle incidents and vulnerability reports.
Your policies, even short ones, for access control, incident response and vulnerability management.
Your providers' reports. Many cloud and database hosts publish SOC 2 reports or trust pages you can point to for the infrastructure layer. Say clearly that they cover the provider and not your application.
A trust page, so the next reviewer finds all of this without emailing you.

Some reviewers will accept this for a lower-risk purchase. Others have a hard requirement that nothing on this list will clear. Ask the reviewer which kind it is; the answer can save you weeks.

Should we get a pen test before the deal closes?

If the contract or the reviewer's policy requires an independent test, yes, and book it soon. Before you call vendors:

Scope drives cost. The number of applications, APIs, user roles and cloud environments matters most, so a single web app with its API costs less than web, API, cloud and network together.
Published prices are vendor estimates and vary widely. One pentest firm writing for startups puts a typical startup test at $4,000 to $12,000, and a focused web app or API test at $4,000 to $6,000 (SecureLeap). A security consultancy says tests bought mainly to be "compliant" can cost around $5,000, while quality testing "often costs $15,000-$30,000" (Fractional CISO). Use these figures to sanity-check quotes.
Vendors describe roughly one to four weeks from scoping to report, plus the time you need to fix issues before a retest (SecureLeap, CyberFortify).
Ask for a retest and a shareable summary up front, since the customer will want both.
Scope the test to what the customer will use. If they'll use your web app and API, test those.

Do I have to send the full report?

Usually not, and never without some protection, because a full report lists the weaknesses in your product. The common practice is to share an executive summary or an attestation letter from the testing firm, often under NDA, stating the scope, dates, tester and remediation status (CyberFortify). NIST's testing guide also expects reports in different formats for different audiences (NIST SP 800-115, section 8.2).

Larger vendors differ here. In its published CAIQ, AWS says it "does not share the results directly with customers" and has its third-party auditors review them. Notion and PostHog make pen test results available through their trust centers. If a customer insists on the full report, the usual condition is an NDA limiting who can read it and for how long.

What does a reviewer look for in a pen test report?

Item	What they check
Date	Is it recent? Reviewers commonly expect a test from the last 12 months (CyberFortify).
Scope	Does it cover the product and environment they will use?
Tester	Is the firm independent of you? The VSAQ asks you to name it.
Method	Did it include manual testing, or only an automated scan? The VSAQ asks this directly.
Findings	Each with a severity rating and a description of impact.
Remediation	Which findings are fixed, which are open, and whether a retest confirmed the fixes.

Open critical or high findings with no plan cause the most trouble. A report showing fixed findings and a retest reads better than a "clean" report with a narrow scope.

Does SOC 2 require a pen test?

No, not by name. In the AICPA's Trust Services Criteria, penetration testing is one example in a point of focus under CC4.1, the monitoring criterion. As quoted by Fractional CISO from the 2022 revised points of focus, management's evaluations "may include first- and second-line monitoring and control testing, internal audit assessments, compliance assessments, resilience assessments, vulnerability scans, security assessment, penetration testing, and third-party assessments." The full criteria are on the AICPA site behind a download form.

So you can have a SOC 2 report without a pen test. A buyer's questionnaire can still ask for one regardless of what SOC 2 says, and having SOC 2 won't answer that question for you.

Where Mobius fits

Mobius Proof & Retest ($500 per scoped question, early access) answers one named question about one condition. After you prove you own the domain and confirm the scope Mobius shows you, it runs one approved check against that condition. You get a PDF evidence brief whether or not the condition is confirmed, remediation guidance where it applies, and one retest of the same condition after the fix. A finding isn't guaranteed.

It is not a full penetration test. It can help when a reviewer has asked about one specific condition and wants evidence that it was checked and fixed. It won't satisfy a requirement for an independent third-party penetration test of your application; if the questionnaire asks for that, book a pen test. To see what's public about your domain first, run the free domain check, which uses public sources only and never connects to your systems.

A customer asked for your pen test report and you don't have one. What now?