Penetration testing is required by every meaningful security framework — SOC 2 CC4.1, PCI DSS Requirement 11, HIPAA Security Rule, ISO 27001 A.8.8, FedRAMP, and increasingly customer security questionnaires. Done well, a pen test is a structured adversarial assessment that produces actionable findings; done poorly, it is a Nessus scan with a cover page. This guide describes the methodology distinctions that matter, the standards that frame the work, and the deliverables that satisfy auditors and customers.
Vulnerability scanners find known issues in known places. Penetration testers find unknown issues, exploit chains across multiple systems, and the operational drift that scanners cannot detect — like the staging environment with production data, the deprecated API still serving traffic, or the IAM role with one too many permissions.
The OWASP Foundation describes the difference plainly in the "Web Security Testing Guide v4.2": "automated tools detect technical issues; humans uncover business-logic flaws and the exploit chains that combine multiple lower-severity issues into a high-severity outcome." The methodology gap matters because the most-cited findings in serious breach reports involve chained low-severity issues, not single high-severity vulnerabilities.
Pen testing is not free-form. Established methodologies define scope, technique, and deliverable expectations. Choosing one (or composing from multiple) signals rigor.
The most widely-adopted methodology for web application testing. 11 testing categories covering information gathering, configuration management, identity management, authentication, authorization, session management, input validation, error handling, cryptography, business logic, and client-side. Each category has dozens of specific test cases with reproduction steps.
Three verification levels:
ASVS pairs well with WSTG: WSTG describes how to test, ASVS describes what good looks like.
The reference list of dominant web application risks. Updated approximately every 4 years; the 2021 list and the 2025 LLM-specific list are current. Top 10 categories anchor pen test scope without being a complete methodology.
"Technical Guide to Information Security Testing and Assessment." Federal-government-grade methodology covering planning, discovery, attack, and reporting phases. Common reference for FedRAMP and federal-adjacent engagements.
Industry-driven methodology with seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting. Less formal than NIST 800-115, broader than OWASP WSTG.
Two axes define an engagement: scope (what is in/out) and knowledge (what the tester knows going in).
Most SaaS engagements run gray box: tester gets standard-tier customer credentials and architecture overview, then probes for both standard customer-tier issues and privilege escalation paths.
A well-run engagement follows the PTES seven-phase model with OWASP WSTG providing the technical depth.
Scope definition, rules of engagement, communication protocols, emergency contacts. The phase that prevents accidents — the tester does not knock production over because the boundaries are documented in advance.
OSINT, asset discovery, attack surface enumeration, threat-actor profiling. Maps what is in scope and identifies what is most worth testing.
The technical work. Vulnerability scanning establishes baseline; manual testing finds the issues scanners miss; exploitation validates that findings are real; post-exploitation maps what an attacker could do after initial compromise. Tools include Burp Suite Professional, OWASP ZAP, Nuclei, Nmap, Metasploit, BloodHound (for AD), Pacu (for AWS).
The deliverable. Executive summary, methodology, findings with CVSS scores, reproduction steps, screenshots, and remediation guidance. The report is the audit-grade artifact.
Customer security questionnaires increasingly ask for tester certifications. The recognized credentials:
Penetration testing benefits from the same engineering depth that builds the systems being tested. Our team brings both the offensive-security skill (OSCP/OSWE-credentialed testers running OWASP WSTG-aligned engagements) and the audit perspective (Bev's compliance background frames findings against the frameworks that customers and auditors actually care about). We deliver findings that are exploitable, not theoretical; reports that are remediation-actionable, not just documentation; and retest cycles that close the loop. Whether you need annual SOC 2 / PCI testing or a continuous adversarial assessment program, the methodology is the same — only the cadence differs.
A practical guide to penetration testing for SaaS companies. Covers OWASP Testing Guide methodology, ASVS verification levels, scoping decisions, and what separates a real pen test from a vulnerability scan.