If you answer yes to three or more of the questions below, it is time to hire a penetration tester. If you answer yes to any of the first three, it was time last quarter.
The checklist
1. Do you store customer data that would embarrass you if it leaked? (personal details, financial records, health data, identity documents, private messages)
2. Has a customer, investor, insurer or auditor asked for a penetration test report or completed security questionnaire?
3. Do you process payments or handle any form of money movement?
4. Do you expose a public API used by third parties?
5. Have you shipped a major new feature, authentication change, or cloud migration in the last six months?
6. Do you have multiple customer tenants or multiple user roles sharing one database?
7. Is there anyone on your team whose full-time job is security? (If no, count this as a yes for hiring.)
8. Have you ever had a secret committed to a public repository?
9. Do you allow users to upload files?
10. Could a full day of downtime cost you more than the price of a test?
Three yeses: book a scoped assessment on your main application. Five or more: you likely need an assessment plus a remediation plan and a retest.
What to prepare before the engagement
Getting these ready before day one saves real money, because the tester spends their time testing rather than hunting for access.
- A list of in-scope domains, API base URLs, IP ranges and mobile builds.
- Test accounts for every role — admin, standard user, read-only, and at least two separate tenants.
- API documentation, an OpenAPI/Swagger spec if you have one, or a Postman collection.
- A simple architecture diagram: what talks to what, where data lives.
- A named engineering contact who can answer questions within a day.
- Agreement on the testing window and a rollback plan if a test environment breaks.
- IP allowlisting for the tester so your WAF does not block the test on day one — or an explicit decision to test with the WAF active.
Questions to ask the tester before signing
Who exactly will do the work, and what are their certifications and experience? (OSCP, CREST, eWPT, OSWE are meaningful; a company logo is not.)
How many consultant-days does the quote include?
How much of the testing is manual versus automated?
Can I see a redacted sample report?
Is a retest included after we fix the findings?
Will I get an attestation letter I can share with customers?
What happens if you find something critical mid-engagement — how fast do you tell me?
What happens after the report
The report is the start, not the end. Triage findings into three buckets: fix this week (critical/high, exploitable now), fix this quarter (medium, needs refactoring), and accept with documentation (low risk, high effort). Assign an owner and a date to each. Then retest — an unverified fix is a hope, not a control.
The one thing founders get wrong
Waiting until an enterprise deal is on the table. Procurement timelines are brutal: scheduling a test, running it, fixing findings and retesting realistically takes six to ten weeks. Start before the deal, not because of it.
---
Need a second opinion on your security posture?
I'm Michael Adeyanju, a penetration tester and security consultant working with companies globally — web app, API, mobile and network security. Based in Lagos, Nigeria, available for remote and on-site engagements worldwide.
Book a 15-minute call: cal.com/michaeladeyanju/15min
See what an engagement covers: michaeladeyanju.com/security-engineer