SaaS & Multi-Tenant Penetration Testing
Manual SaaS penetration testing across Europe: tenant isolation, RBAC and billing logic tested by OSCP/OSWE engineers. Free retest and a fixed quote.
SaaS penetration testing exists to answer the one question every customer of a multi-tenant product silently asks: can one tenant reach another tenant’s data? We test that boundary hard, along with the roles, billing logic and integrations that make a SaaS platform its own kind of attack surface.
A multi-tenant application concentrates risk. A single flaw in how tenant context is enforced does not affect one customer, it affects all of them at once, and it is the finding that ends up in a breach notification to your entire book of business. Generic web-app testing checks the front door. SaaS pen testing checks whether the walls between the rooms actually hold.
What SaaS penetration testing actually covers
We test the platform as attackers who have signed up as legitimate tenants, because that is the realistic threat: not an anonymous outsider, but a paying customer, or someone who compromised one, trying to reach across the boundary. From there we go after isolation, privilege, and the business logic that a SaaS product lives and dies by.
How we run a SaaS pen test
The engagement is authenticated and role-aware from the start. We provision at least two tenants and several roles within each, then work systematically to break the assumptions your code makes about who is asking and on whose behalf. This is what SaaS application penetration testing has to be: black-box scanning alone never finds a cross-tenant IDOR.
Reconnaissance and mapping
We map every route, the API behind it, and how tenant context is carried, whether that is a subdomain, a header, a JWT claim or a value in the request body. The way a platform decides “which tenant is this” is usually where the interesting flaws begin.
Tenant isolation testing
The heart of the engagement. From tenant A we try to read, modify and delete tenant B’s records by manipulating identifiers, replaying tokens, and abusing endpoints that forgot to scope their query. We check object-level access on every meaningful resource, because one unscoped endpoint is enough to break the whole promise of the product.
Object-level and function-level authorization
We test both dimensions of access control: can you reach an object you should not (a specific invoice, file or user), and can you call a function you should not (an admin action, a plan change, an export). Broken object-level authorization is consistently the highest-impact class we find in SaaS security testing.
Privilege escalation and admin surfaces
We look for ways a normal user becomes a tenant admin, a tenant admin reaches platform-level control, and support or impersonation features that can be turned against customers. Impersonation is a common and dangerous feature, and we test whether it can be invoked by someone who should not have it.
Business logic and billing
SaaS runs on rules: seat counts, usage quotas, trial limits, feature flags tied to a plan. We test whether those rules can be bypassed to get paid features for free, exceed quotas, or manipulate usage that drives invoicing. These findings rarely appear in a scanner and often surprise the team that built them.
Reporting
You get a report that names the exact tenant, endpoint and identifier for every finding, so a developer can reproduce it in minutes, plus a call to work through remediation.
Common SaaS vulnerabilities we find
Across platforms, the same high-impact issues recur. The list below covers where most of our serious SaaS findings live.
Cross-tenant data exposure
The signature SaaS flaw. An endpoint fetches a resource by ID and trusts the ID without checking it belongs to the caller’s tenant. Change the number, read another company’s data. It is common, it is critical, and it is exactly what regulators and customers care about.
Broken role-based access control
Permission checks enforced in the UI but not the API, roles that inherit more than intended, and invite flows that let a low-privilege user grant themselves more. RBAC that looks right on screen is often wrong on the wire.
Identity and SSO misconfiguration
SAML responses accepted without proper signature validation, OAuth flows that can be redirected, and tenant SSO settings that allow account takeover across an organisation. Identity is the front door to a SaaS platform, and it is frequently the softest part.
Insecure integrations and webhooks
Webhook endpoints without signature verification, integration tokens with excessive scope, and secrets exposed to tenant admins who should not see them. Each connected service widens the surface, and each is worth testing on its own.
API weaknesses
The API is where the real logic lives, and it is where mass assignment, excessive data exposure and missing rate limits show up. We test the API directly against the OWASP API Security Top 10, not just the UI sitting on top of it.
Tools and how we work
The testing is manual, supported by Burp Suite Professional for intercepting and manipulating traffic, custom scripts for tenant-by-tenant comparison, and tooling to enumerate API endpoints and GraphQL schemas. For platforms built on major clouds, including Oracle SaaS and other enterprise stacks, we account for the platform’s own identity and tenancy model in the test plan. The tools accelerate the work; the findings come from an engineer reasoning about what each identity should and should not be able to do.
Want this tested on your own systems?
Free 20-minute scoping call, a fixed price with no hourly surprises, and a free retest once you fix what we find.
What you get
The deliverables are written to be fixed fast and to satisfy the audit your customers will ask about.
- An executive summary that states the isolation and access risk in terms a buyer’s security team will recognise.
- A technical report with each finding scored by CVSS, the exact tenant, endpoint and identifier, reproduction steps, and a specific fix.
- Findings prioritised by real impact, so cross-tenant and privilege issues come before cosmetic ones.
- A remediation call with the reviewing engineer and a free retest once you have fixed.
- An attestation letter your sales team can share with prospects, mapped to the framework you report against.
Compliance and standards
For a SaaS company, a pen test is often a commercial requirement, not just a security one. SOC 2 is the report your enterprise customers ask to see, and its criteria expect independent testing. ISO 27001:2022 control A.8.29 covers security testing in development, and A.8.3 covers information access restriction, which maps directly to tenant isolation. GDPR requires appropriate technical measures for personal data, and PCI DSS applies if you handle cardholder data. We align the report and attestation to whichever your prospects and auditors expect.
What a cross-tenant breach looks like
The reason this test matters is best shown, not asserted. Picture a support tool where every ticket has a numeric ID, and the endpoint that loads a ticket checks that you are logged in but not that the ticket belongs to your company. A curious customer increments the ID in the URL and starts reading other companies’ support conversations, some of which contain passwords and personal data.
Why it stays hidden
Nothing about that flaw shows up in normal use, in the interface, or in a vulnerability scan. The application behaves perfectly for everyone following the intended path. It only surfaces when someone tampers with an identifier, which is exactly what we do systematically across every resource in your platform. One unscoped endpoint is enough to expose your entire customer base.
The fix and the retest
The fix is almost always to scope every query by the caller’s tenant at the data layer, not just to hide the option in the interface. We point to the exact endpoints at fault, and the free retest confirms the boundary now holds under the same attacks that broke it.
Testing without a full staging copy
Not every SaaS team has a production-like staging environment, and we work with that. For isolation and access-control testing we can operate safely against production using dedicated test tenants and accounts we control, agreeing in advance which actions are off limits. Where a genuine staging environment exists, it is the better place for the noisier checks, and we will use it. Either way, live customer data is never our test material.
Pricing
The saas penetration testing cost depends on the size of the application, how many roles and tenant types exist, whether there is an API and SSO to cover, and how much business-logic testing you want.
| Engagement | What’s included | Timeline | Price |
|---|---|---|---|
| Core platform | One SaaS application, two tenants, standard roles, tenant-isolation and RBAC testing, API coverage, full report and free retest | 4–6 working days | from €3,500 |
| Standard | Multiple roles and tenant types, REST and GraphQL API, SSO/SAML/OAuth, business-logic and billing testing, exec + technical report | 6–10 working days | €5,000–€12,000 |
| Advanced / enterprise | Complex multi-tenant platform, admin and impersonation surfaces, integrations and webhooks, attack-chaining across tenants and roles | 10–15 working days | €12,000–€25,000 |
| Compliance add-on | Mapping and attestation letter for SOC 2, ISO 27001, GDPR or PCI DSS | with any tier | from €800 |
| Custom / large estate | Multiple products or a platform with many services, scoped to your needs | on scoping | custom |
Every engagement is fixed-price, quoted after a free 20-minute scoping call — no hourly surprises, and a retest is included. Get a fixed quote
FAQ
How much does SaaS penetration testing cost?
Do you test our production environment or a staging copy?
How do you test multi-tenant isolation?
Will a SaaS pen test satisfy our SOC 2 or ISO 27001 audit?
Can you test platforms built on Oracle SaaS or other enterprise stacks?
Do you test the API as well as the web interface?
What will you actually deliver?
Will the testing disrupt our customers?
Related services
SaaS companies whose customers ask for a SOC 2 or a pen-test letter before they buy, product teams running a multi-tenant platform where one isolation flaw would affect every customer, and any B2B software business preparing for enterprise procurement. We are a European offensive-security team working with clients EU-wide and remotely.
Security you can prove
The same standard on every engagement, big or small.
Evidence, not opinions
Every finding ships with a reproduction and proof of concept — no vague "maybe vulnerable".
Humans over scanners
Certified engineers find the logic flaws and chained attacks automated tools walk straight past.
Fixed price, free retest
You know the cost up front, and verifying the fix is part of the deal — not a second invoice.
Ready to lock this down?
Free scoping call, fixed price, free retest. Tell us what you're running and we'll take it from there — usually within one business day.
Tell us what you're running
Scoping is free. We reply within one business day, and under 30 minutes for active incidents.