Respond to a report request
Work through a request that has already arrived.
Read nextPrepare before the buyer asks
Don’t let a missing pentest stall your next deal.
The demo went well. Your prospect wants to move forward. Then their security team asks for your latest pentest report before they approve the purchase. You do not have one. Now the sales conversation is waiting on work you have not scheduled.
Published by Trespass Security
Protect the momentum
A report is not something you can produce overnight.
You may need to find an available tester, agree what to test, prepare access, complete the test, and wait for the report. That can take weeks. If the buyer needs issues fixed and checked again, the timeline gets longer.
Meanwhile, your champion still has to explain why the purchase is waiting. Their deadline may arrive before your evidence is ready. The practical reason to plan ahead is simple: give yourself time to do the work before a live deal depends on it.
Not every buyer requires a pentest. Start by finding out what the customers you want to win are likely to ask for.
Ask early
Find out what could stand between a good demo and a signed deal.
Ask how the buyer approves new software.
During an early sales conversation, ask whether there is a security review and who owns it. Find out whether a pentest report is required, how recent it needs to be, and when they will review it.
Get the actual requirement.
“We need a pentest” leaves room for expensive misunderstandings. Ask which app or systems must be covered, what document they expect, and how they handle unresolved findings.
Check before commissioning work.
Share the proposed coverage and report format with the buyer when possible. A report for a different app, an outdated version, or the wrong testing may not help this deal.
Work back from the buyer’s date
Leave time to fix what the test finds.
Ask your provider for separate dates for starting the test and delivering the report. Then plan time for your engineers to make fixes, any agreed retest, and the buyer’s review.
A tester might discover that one customer can see another customer’s data or that an ordinary user can perform admin actions. Those findings need attention; a report alone does not make them go away.
Before booking, explain the app’s user roles, customer workspaces, APIs, integrations, and upcoming changes. Agree a suitable test environment, working test accounts, written permission, and safety limits. The provider should help you define the work.
If the app is still being rebuilt or you already know important access checks are missing, fix or review those parts first. Plan the test around a stable version instead of buying evidence that will be outdated before the buyer sees it.
Be ready to answer
Have current, relevant evidence—and know how you can share it.
Keep track of what was tested, when it was tested, what changed afterward, and which findings were fixed or retested.
Before sending a report, check who may receive it and how it should be protected. A technical report can reveal sensitive details. Some buyers may accept a summary; others need a controlled review of more detail. Confirm their needs rather than sending everything automatically.
A pentest cannot prove that an app has no vulnerabilities, guarantee customer acceptance, or guarantee a sale. What it can give you is investigated evidence and a clearer account of the issues your team has addressed.
Already been asked?
Give the buyer a clear next step.
Ask for the requirement and deadline in writing. Check any existing report against them, then speak to a provider about the work still needed.
Do not promise a report date until availability, coverage, and preparation are confirmed. If the deadline is tight, tell the buyer what you can establish now and what still needs to happen.
Our customer report-request guide walks through that conversation, including a sample response. Use this guide earlier, while you still have time to prepare.
Next step
Tell us about your app—and the customers you want to win.
Send a brief, non-sensitive summary of your app, the buyers you are speaking with, any testing requirement, and your timeline. We can discuss what to confirm and prepare before a missing report becomes a last-minute obstacle. Keep credentials, customer data, and technical vulnerability details out of the initial request.