Your first enterprise deal wants a pentest
Trident attacks each deploy, proves what is exploitable, and opens the fix your next security questionnaire can cite.
Annual pentest
Trident on every deploy
criticalExploitable on the latest run
A deploy opened this path
The gate every release runs
A webhook feature fetches whatever address it is given
EntryWebhook test buttonImpactCustomer file store
Reproduced on a fresh deploy
Inside a single run
Recon
A URL or repo maps routes, APIs, and cloud surface.
Path mapping
Each change traces into routes ending at customer data.
Exploit validation
A route becomes a finding only when it reproduces.
Draft PR + report
The fix opens against your repo; the report holds evidence.
The document the deal waits on
The pentest row on the security questionnaire, answered with a document instead of a promise.
- Scans trigger from CI on each deploy, or on demand
- Findings open as pull requests with the failing check attached
- Evidence bundles reproduction, patch, and retest in one place
- Cloud access is read-only, scoped, and expiring
What the security review will ask for
Enterprise security questionnaires converge on a short list.
Deal blockers
Most startups test because an enterprise security review is blocking a deal. That deadline shapes the answer: a scoped test, findings a small team can fix, and a retest proving closure. The flaw on this page is ordinary and severe — a webhook feature that will fetch any address you hand it, including the cloud’s own credential service.
- A scoped penetration test
- Defined targets, authorization, methodology and dates — the first thing a reviewer looks for, and what a scan report cannot substitute for.
- Evidence per finding
- Reproducible proof rather than severity labels, so your engineers can fix quickly and the reviewer can see the work was real.
- Remediation and retest
- A record that findings were fixed and verified. An open critical with a credible fix date beats a closed one without retest.
- Cloud configuration review
- The attack paths through your AWS, Azure or Google Cloud accounts — a short list, usually including an over-permissive CI role.
- Tenant isolation, if multi-tenant
- Whether one customer can reach another customer data. For B2B SaaS this is the deal-ending finding, and it is usually tested last.
Questions founders ask before the first test
Close the deal with the pentest done.
See a run attack your surface and open the fix.
A URL is enough to start.