A Scanner Report Is Not a Pentest. Procurement Already Knows the Difference.

A security questionnaire is an evidence request, not a form. Buyers using SIG, CAIQ, VSAQ or a custom spreadsheet want proof of four things: that an independent party tested the application, that access to it is controlled, that you can detect and report an incident, and that you know where the data sits. Most deals stall on the first, because teams answer "we run automated scans" to a question that asks for a penetration test.

Because the breach data moved. Nearly half of the breaches that hit an enterprise now arrive through someone else's environment, and that someone is a vendor.

The 2026 Verizon Data Breach Investigations Report found third-party involvement in 48% of all analysed breaches, a 60% increase year over year, after that figure had already doubled from roughly 15% to 30% in the 2025 edition. The same report put exploitation of vulnerabilities at about 31%, overtaking credential abuse (down to 13%) as the most common initial access vector.

Read those two findings together and the buyer's logic is obvious. Their most likely breach path runs through a supplier, and the most likely entry point is an untested application. You are the supplier. The questionnaire is how they price that risk before signing.

Regulation pushed the same way. NIS2 makes supply chain security an explicit obligation for in-scope entities, and DORA requires financial firms to manage ICT third-party risk down to contractual incident notification. When your buyer is regulated, the questionnaire is not their preference. It is something their supervisor will ask them about.

Four formats cover most of what SaaS and services companies see.

The format matters less than the pattern. Every one of them resolves to the same handful of evidence requests wearing different phrasing.

Four asks decide most deals.

Phrased as: "Are penetration tests performed at least annually by a qualified independent party, and can you provide a summary report or attestation?"

This is where most responses fail, and the failure is usually honest. The team runs a scanner, sees a clean report, answers yes. Procurement asks for the report, receives scanner output, and sends the question back. Two weeks and some credibility, gone.

A vulnerability assessment and a penetration test are not the same deliverable. A vulnerability assessment is automated discovery plus manual validation of high-severity findings. It is legitimate and audit-recognised (it maps to ISO/IEC 27001 Annex A 8.8 on technical vulnerability management) and it is the right first step for a small, low-complexity target. What it does not include is deep manual exploitation or business-logic testing, which is exactly what procurement means by "penetration test".

So the real question is which tier the buyer's ask maps to. Application size, roles behind the login, authentication method and API surface all move that answer, and so does the reason you are testing. Our penetration testing cost calculator scores those seven inputs and returns a published EUR price with no form. One detail matters for questionnaires specifically: if your scope is small enough to land in the Vulnerability Assessment band but the engagement is driven by a customer questionnaire, an audit or a regulation, the tool raises the recommendation to a Focused Web App Penetration Test, because a vulnerability assessment usually will not be accepted where a penetration test is named.

Whatever you buy, ask for the two things the questionnaire needs: a signed attestation letter (short, states what was tested, when, under which methodology, and the current remediation status) and findings mapped to CVSS v3.1 and OWASP Top 10:2025. Every one of our tiers includes the attestation letter as standard, and it names the work correctly, vulnerability assessment or penetration test, because that distinction is exactly what a reviewer is checking. The full technical report almost never leaves your company, and buyers rarely ask for it.

Phrased as: "Is MFA enforced for all administrative access, and how often is access reviewed?"

The DBIR data explains the emphasis. Verizon reported that only 23% of third-party organisations fully remediated missing or misconfigured MFA on cloud accounts, and that resolving half of weak-password and permission findings in third-party cloud environments took a median of almost eight months.

Answer with specifics: which systems, enforced how, reviewed on what cadence, and what happens the day someone leaves. A named offboarding procedure with a time target beats an adjective.

Phrased as: "Do you have a documented and tested incident response plan, and what is your notification commitment?"

Two words carry the weight: documented and tested. A plan that has never been exercised is a document, not a control. The notification window is a contractual answer rather than a technical one, because GDPR and DORA both push notification obligations down the chain. Give a number of hours, and be certain you can meet it.

Phrased as: "List all subprocessors, the data each handles, and the countries where data is stored and backed up."

The gap this exposes most often is backups. Production sits in the EU, backups quietly land in a US region, nobody wrote it down. Under GDPR Articles 44 to 49 that is a transfer question, and it is one of the few answers a buyer can verify independently.

"Penetration test" is not one product. Buyers rarely care which tier you buy, only that the scope actually matches the word used in the questionnaire. Six tiers cover almost every scenario:

By changing the order of operations. Questionnaires rarely stall on the writing. They stall because the answer to question 34 needs an artefact that takes three weeks to produce, and nobody started until the questionnaire arrived.

A workable sequence if you sell to enterprise and have not been asked yet:

Back in 2022, Gartner predicted that by 2025, 60% of organisations would use cybersecurity risk as a primary determinant in conducting third-party transactions and business engagements. Judging by the DBIR numbers and by what now arrives with every enterprise deal, that prediction landed. The questionnaire is not an obstacle in front of the deal. It is part of the deal, and it returns with every renewal.