An enterprise security questionnaire asks four things about your penetration testing: was it done by an independent third party, is it recent (usually within the last 12 months), did it cover the product the customer is buying, and were the critical and high findings fixed and retested. Answer with a customer-shareable executive summary or attestation letter, and offer the full report under NDA. CodeAnt AI fits SaaS and fintech teams that need that evidence quickly: an AI pentest with exploit-proven findings, reviewed by security researchers, and an audit-grade report within 48 hours.
CodeAnt AI has run 12,000 pentests and is trusted by more than 1,000 companies, including Fortune 500 companies like NRG, cybersecurity leaders like Commvault, and fast-growing companies like 11x and Sanas.
This guide maps each pentest question a questionnaire asks to the document that answers it, compares how six providers package customer-facing evidence, and gives a step-by-step plan for when a questionnaire lands before your test is done.
What Does a Vendor Security Questionnaire Ask About Penetration Testing?
The format changes from buyer to buyer: SIG from Shared Assessments, the Cloud Security Alliance's CAIQ (version 4.1, released January 2026), EDUCAUSE's HECVAT for higher education (version 4.1.6), or a custom spreadsheet. The pentest questions inside them come down to eight checks. Large buyers can go further. Google's Vendor Security Assessment, for example, starts with a vendor questionnaire and may then require a penetration test of any SaaS application Google uses, scoped to all infrastructure, applications and endpoints used to provide the service.
What they ask | What the reviewer is checking | What to send |
|---|---|---|
When was your last penetration test? | A test in the last 12 months, and again after major changes | The report date on your executive summary or attestation letter |
Who performed it? | An independent third party, not your own team or a scanner | Provider name, reviewer sign-off and the provider's credentials |
What was in scope? | The product they are buying, including logged-in user roles | A scope statement: domains, apps, APIs, cloud accounts and box type |
What methodology was used? | A recognized method, such as OWASP categories or NIST SP 800-115 | The methodology section, listing the categories tested |
What did it find? | Findings by severity, and whether the test went deep enough | Severity counts in the summary; full findings under NDA |
Were the findings fixed? | Critical and high issues closed, or on a dated plan | Retest results and remediation status by severity |
How often do you test? | A program, not a one-off | Your cadence: annual plus major releases, or continuous |
How was testing kept safe? | No risk to production or to the buyer's data in your systems | Rules of engagement, the test's request log and your data handling terms |
The fifth row is where shallow tests fail. A report made of low-severity hygiene findings (missing headers, TLS settings) tells a reviewer the tester never got past the login page. Reviewers look for proof that authorization was tested: can one tenant read another tenant's records, can a basic user call an admin API. That takes a grey box test with test accounts, not only an external scan. NIST defines penetration testing as security testing in which evaluators mimic real-world attacks to find ways around a system's security features; a scanner export does not meet that bar.
Which Document Should You Send: Attestation Letter, Executive Summary or Full Report?
Send the lightest document that answers the question, and keep the full report behind an NDA.
Attestation letter. One page on the provider's letterhead confirming who tested what, when, and against which method, with a categorical summary of results and no exploit detail. It suits questionnaires, procurement portals and onboarding forms.
Executive summary. A few pages covering scope, methodology, findings by severity and how many are fixed. This is the document most buyers forward to their risk team.
Full report. Every finding with evidence, reproduction steps and fixes. Share it only under NDA, only when asked, and ideally after the retest so it shows closed findings. Store and send it with the care you give credentials.
Security leads we speak with in fintech and SaaS describe the same need: they want to show a banking partner or enterprise customer the line items of a pentest without handing over personal data, full URLs or a map of their stack. Several also share the report with their own customers, so it has to read well outside the security team.
That is why a good pentest report is written for three readers. The auditor wants every finding mapped to controls. The customer wants proof the product was tested and fixed. The engineer wants the exact steps to reproduce and fix each issue. One report with a forwardable front section and a technical back section serves all three, and you never have to redact a PDF the night before a deal closes.
How Recent Does the Pentest Need to be?
Most enterprise reviewers expect a test at least once a year, plus a retest after significant changes. Some evidence expires faster: Astra's publicly verifiable pentest certificate, for example, is valid for 180 days. If your last test predates a major release, a new feature that touches customer data, or a new cloud environment, expect the reviewer to ask for a fresh one.
Questionnaire versions change too. CSA's STAR registry accepts both CAIQ v4.0 and v4.1 submissions until December 2027, then v4.1 only, so check which version your buyer sent before reusing old answers.
What if the Questionnaire Arrives Before Your Pentest is Done?
This is the common case: the questionnaire shows up mid-deal and the last test is stale or never happened. Work through it in this order.
Ask the reviewer what they will accept: an attestation letter, an executive summary, or the full report under NDA, and whether their program specifies scope or testing method.
Scope the test to the product in the deal: the production web app, its APIs, the logged-in roles and the cloud accounts that hold customer data.
Pick the depth. Black box shows what an outside attacker sees from your domain. Grey box adds test accounts to prove tenant isolation and role checks. White box adds code and cloud access for depth.
Run the test and fix critical and high findings first.
Retest, and keep the record that each finding is closed.
Send the attestation letter or executive summary with your questionnaire answers, and offer the full report under NDA.
Put the next test on the calendar now: annual plus major releases, or a continuous program.
If the test is still running when the questionnaire is due, say so and give the date the report will land. Reviewers handle a dated commitment better than a stale report.
Will an Enterprise Reviewer Accept an AI Penetration Test?
After price and data handling, this is one of the questions security leads ask us most. Reviewers judge the evidence, not the tool. They check that a third party tested the right scope, that findings are real (an exploit, not a scanner guess), that a person reviewed them, and that fixes were retested. An AI pentest that ships exploit-proven findings, reviewed by security researchers, with a signed report after remediation, answers each of those checks. Our guide to AI pentesting for compliance evidence covers this in more depth.
Two caveats are worth knowing before you buy:
Some programs specify the method. Google's Vendor Security Assessment says the largest share of testing must use manual methods, and that the supplier must give the testers login credentials. If a customer's contract or program says something similar, confirm with them before choosing any AI-led provider.
Your own testing does not count. Teams that already run black and grey box tests on themselves with open source tools still need an outside test for SOC 2 and for customer reviews, because the questionnaire asks for independent evidence.
The market shows how real the acceptance worry is: Intruder offers a full refund if an auditor rejects its AI pentest report.
How Do Pentest Providers Package Questionnaire-Ready Evidence?
Prices and terms below come from each provider's own pages.
Provider | Model | Time to report | Customer-shareable evidence | Retesting | Pricing model | Main tradeoff |
|---|---|---|---|---|---|---|
AI pentest with exploit-proven findings, reviewed by security researchers; black, grey and white box across web apps, APIs, cloud, Kubernetes, Active Directory and networks | Within 48 hours | One-page grade for the board, a customer-facing summary, findings mapped to SOC 2 and ISO 27001, signed report after fixes | Free, unlimited re-scan after a fix | Priced on your attack surface; pay only when a working proof-of-concept exploit is shipped | If a customer program requires mostly manual testing, confirm the AI-led approach with them first | |
PTaaS with human pentesters plus an autonomous pentest | Autonomous pentest in 24 hours; human-led tests launch within 24 hours | Customer letter and attestation; reports mapped to SOC 2, ISO 27001, HIPAA and PCI DSS | Free retesting within a seven-day SLA | Credit-based subscription | Per-test cost is hard to compare without a quote | |
AI white-box web app pentest with repository access | Same day | Report usable as ISO 27001 and SOC 2 evidence; refund if the auditor rejects it | Unlimited | 3,500 USD per test, or 12,000 USD for four | Web applications only; no attestation letter listed | |
PTaaS: autonomous Pentest Auto plus manual Pentest Expert | Same day for Pentest Auto; 10 to 15 working days for a manual pentest | Pentest report for SOC 2, ISO 27001 and HIPAA; publicly verifiable certificate after fixes are re-scanned, valid 180 days | One to four re-scans within 30 to 90 days, by plan | 2,999 USD a year (Auto), 5,999 USD a year (Expert), Enterprise from 9,999 USD | Few re-scans per window; certificate needs renewing every six months | |
AI pentest that pauses for review before escalating | Same-day results | Customer report that does not expose your stack, plus a letter of attestation for RFPs and due diligence | Retest findings for up to 6 months | 4,000 USD per test for one app and its main APIs; no high or critical findings, no pay | Fixed scope of one application per test | |
Stingrai | AI agent working alongside certified human testers | Days to a few weeks from scoping to evidence pack | Attestation letter, executive summary and retest record | Retest included | 6,800 USD for one web app and its APIs, or 1,275 USD a month on a 12-month plan | Priced per application; larger scopes need a quote |
How Does CodeAnt AI Produce Questionnaire-Ready Evidence?
CodeAnt AI has run 12,000 pentests and is trusted by more than 1,000 companies, including Fortune 500 companies like NRG, cybersecurity leaders like Commvault, and fast-growing companies like 11x and Sanas.
The test. CodeAnt's agents map your external attack surface, chain findings into attack paths, and prove each one with a working exploit. CodeAnt's security researchers review the findings and go deeper where the agents stop. Black box needs only your root domain. Grey box adds test accounts to check roles, tenant isolation and insecure direct object references. White box adds code and cloud access. Coverage spans web apps, APIs, cloud, Kubernetes, Active Directory, and internal and external networks.
The report, within 48 hours, written for every reader of a security review:
For your board: one letter grade on one page.
For your auditor: every finding mapped to SOC 2 and ISO 27001.
For your prospect: proof you are clean, while your stack stays private.
For your engineers: the attack chain, reproduction steps and the fix, pushed to Linear.
The evidence trail. Every request the test sends is logged with its timestamp, so you can show a reviewer exactly what was tested. After a fix, hit Reverify: re-scans are free and unlimited. Once the findings are closed, CodeAnt's security researchers sign the final report you hand to auditors and customers.
Pricing. CodeAnt prices each pentest on the attack surface you have, and gives very generous pricing to fast-growing companies. You pay only when CodeAnt ships a working proof-of-concept exploit; if nothing exploitable is found, there is no charge.
Proof. CodeAnt AI is SOC 2 Type II and a Gartner Cool Vendor 2026, holds CERT-In empanelment, and has published more than 100 CVEs as a VulnCheck CNA partner, including CVE-2026-29000 in pac4j-jwt (CVSS 10.0) and CVE-2026-28292 in simple-git (CVSS 9.8). Phunware called it "the most advanced and thorough penetration test we've run to date."
If a questionnaire is waiting on your pentest, request a test at codeant.ai/pentesting.
