Will testing impact our production environment?

No, and that's by design. Every engagement runs under signed Rules of Engagement that define exactly what we test, when, and how. High-risk actions on production — anything that could affect performance, data integrity, or real users — are coordinated with you in advance and only executed with your explicit approval. We've never taken down a client's production environment, and our process is built to keep it that way. If you'd prefer testing on staging, we'll work with what you have. We don't require a separate environment to deliver real findings — we adapt to yours.

Will your report pass our auditor and our Enterprise customer's security review?

Yes. Our testing is built on OWASP WSTG, PTES, and NIST SP 800-115 — the methodologies SOC 2 and ISO 27001 auditors expect to see. Each report includes an Executive Summary written for procurement and leadership, and a Technical Report with reproduction steps and remediation guidance for engineers. Our reports have been accepted by the security teams of global Enterprises — including some who hired us directly to test their own SaaS vendors. They will pass yours.

What if you don't find any vulnerabilities?

This is rare — in the engagements we've run on B2B SaaS, we've always found something worth reporting. But if we don't, you still get the full deliverables: a report confirming the depth of testing performed, the methodologies applied, and the components covered. That report is the same artifact your auditors and Enterprise customers need. A clean pentest from a senior team is also a meaningful result — and one that few products can actually claim.

How do you handle confidentiality, our data, and legal accountability?

Every engagement starts with a signed NDA and a contract with XRAY Cybersecurity — full corporate liability and legal accountability. Findings, exploitation evidence, and any data accessed during testing are stored encrypted, accessed only by the assigned engineers, and deleted from our systems after the engagement closes (with the exact retention period defined in your contract). We carry professional indemnity insurance, and our team operates under strict internal data handling policies. If something goes wrong, you have a company to hold accountable — with legal recourse, not a hope.

How much effort does this require from our team?

Less than most clients expect. The setup is concentrated in the first few days — provisioning access, sharing documentation, and walking through your architecture in a kickoff session. After that, your team's involvement is mostly answering occasional clarifying questions. The real time investment comes during remediation, when your engineers fix the findings. That's on your timeline, not ours — and we support them with direct technical guidance rather than adding more meetings.

Do we need to disable WAF, whitelist your traffic, or coordinate with our SOC and monitoring during testing?

We discuss all of this during the kickoff session and adapt to your setup. For most engagements, we recommend either whitelisting our IPs at the WAF level (so we test the application, not your perimeter) or testing the WAF behavior explicitly as part of scope — your choice. If you have a SOC or monitoring team, we coordinate notifications so our testing doesn't trigger an unnecessary incident response. We aim to minimize noise — but we don't disable any protections without your decision.

What if we need to pause or postpone the engagement?

It happens — release crunches, internal incidents, leadership changes. We've designed our process to accommodate this. Pauses are coordinated with your team, the engagement timeline shifts accordingly, and there's no penalty for reasonable rescheduling within the engagement period.

Is retesting included? How long do we have to fix the findings before we lose the chance to retest?

Retesting is included in every engagement — there's no separate charge. After your team remediates the findings, we re-test each one against the original exploitation to verify the fix actually holds, and issue an updated Technical Report and Security Certificate. The retest window is agreed up front and reflected in your engagement scope, so your team has the time it actually needs to remediate. We don't push, we don't drag, and we don't bill you again for work that should have been part of the original engagement.

Are there any hidden fees? What's actually included in the price?

The price you see in the proposal is the price you pay. It's fixed, written into the contract, and tied to the agreed scope. Full cycle from kickoff to final certificate is included — testing, all reports (Interim Urgent, Technical, Executive Summary, Retest), the debrief call, remediation support, retesting, and the Security Certificate. There are no hidden fees, no per-finding charges, no extra invoices for retests, reports, or follow-up calls. The only reason the price changes is if you decide to expand the scope mid-engagement — adding new components, new roles, or new applications. In that case, we estimate the additional effort and agree the change with you in writing, before any work begins. Nothing surprises you on the invoice.

Pentesting manual de aplicaciones para B2B SaaS

Ejemplo: Inyección SQL

Nivel 1 — Superficial

Detectar y señalar

Resultado típico de escáneres, freelancers, bug bounty

Un escáner detecta una inyección SQL en un parámetro de URL. El informe la marca como «Alta». Nada más.

Nivel 2 — Estándar

Confirmar y reportar

Resultado típico de la mayoría de proveedores de pentest

Un tester confirma la inyección, extrae varios registros de usuario como prueba, redacta el hallazgo. Fin del trabajo.

Nivel 3 — Profundo

Encadenar e impactar

Resultado típico de XRAY CyberSecurity

Identificar la SQLi, extraer registros de usuario, correlacionarlos con credenciales de un backup olvidado en un subdominio hermano, identificar objetivos de alto valor, explotar un fallo de aislamiento entre tenants, construir una herramienta a medida para obtener acceso administrativo — y demostrar el camino para comprometer los datos de su cliente Enterprise.

Ejemplo: Cross-Site Scripting

Nivel 1 — Superficial

Detectar y señalar

Typical result for scanners, freelancers, bug bounty

Un escáner detecta un XSS reflejado en un campo de búsqueda. Marcado como «Medio». Listado.

Nivel 2 — Estándar

Confirmar y reportar

Typical result for most pentest vendors

Un tester confirma el XSS, demuestra un popup como PoC mostrando acceso al token de sesión, registra el hallazgo. Listo.

Nivel 3 — Profundo

Encadenar e impactar

Typical result for XRAY CyberSecurity

Identificar el XSS, construir un PoC que exfiltra tokens de sesión, entregarlo a usuarios de la plataforma, recolectar tokens, pivotar a través de un fallo de validación de roles para escalar privilegios, dirigirse a admins por la misma vía, robar tokens de admin, secuestrar la administración del tenant — y demostrar la toma de la plataforma, incluido el camino para comprometer a los clientes Enterprise.

Cadenas personalizadas

Cada SaaS tiene su propia cadena de ataque

Su plataforma tiene la suya — posiblemente varias — incrustadas en su arquitectura, lógica de negocio y APIs.

A veces la cadena lleva a un compromiso total. A veces sus defensas la cortan a la mitad — y reportamos exactamente dónde y por qué.

En cualquier caso: usted ve lo mismo que ve un atacante.

Pruebas de penetración manuales de aplicaciones para B2B SaaS

¿Le resulta familiar?

Un acuerdo Enterprise está bloqueado en la revisión de seguridad.

Tiene una auditoría SOC 2 o ISO 27001 en el calendario.

Espera no ser la próxima brecha en las noticias.

Ha habido un incidente.

Se acerca su próxima ronda o una operación M&A.

Su último pentest fue un mero trámite.

El coste de la inacción

Qué hay que probar

Black-box

Grey-box

Clases de vulnerabilidades a cazar

Superficie de aplicación a cubrir

Qué significa realmente manual

Ejemplo: Inyección SQL

Detectar y señalar

Confirmar y reportar

Encadenar e impactar

Ejemplo: Cross-Site Scripting

Detectar y señalar

Confirmar y reportar

Encadenar e impactar

Cadenas personalizadas

Cada SaaS tiene su propia cadena de ataque

¿No tiene claro qué entra en el alcance para su producto? Definamos juntos el ajuste ideal.

Qué recibirá

¿Quiere ver cómo son realmente?

Informe urgente intermedio

Informe técnico

Resumen ejecutivo

Informe de re-test

Certificado de seguridad

Cómo cumplimos con sus objetivos

Estándares

Metodologías que seguimos

Requisitos de pentest de cumplimiento que satisfacemos

Los principios detrás de ello

Hacking manual

Cíclico, no lineal

Impacto de negocio, no una lista de bugs

Solo ingenieros senior

Calidad antes que velocidad

No causar daño

Hallazgos accionables, cero falsos positivos

Comunicación de ingeniero a ingeniero

Hacking como oficio

De su primer mensaje a su certificado final

Primera conversación

Alcance y propuesta

Arranque

Reconocimiento y threat modeling

Explotación activa

Entrega del informe principal

Llamada de cierre

Soporte durante la remediación

Re-test y certificado final

Reconocidos por la industria

En sus propias palabras

¿Listo para probar su aplicación?

Preguntas frecuentes

Hablemos.