Questionnaire answer guide
How to answer ‘Do you perform penetration tests?’ in a security questionnaire
Who this guide is for
SaaS founders, engineering leaders, security owners, and sales engineers completing customer security questionnaires.
Key takeaways
- Do not equate automated scanning with penetration testing.
- Qualify every yes with scope and recency.
- Use customer-safe summaries rather than raw findings by default.
- Represent scheduled work as planned, not completed.
- Route contractual frequency promises for approval.
Interpret the full question
Questionnaires often compress several issues into one yes/no cell: whether testing occurs, how often, who performs it, what systems are covered, whether findings are remediated, and whether customers can see results. Answer each material element in a comment or evidence field.
Use the completed engagement as the source of truth
Confirm the authorization, provider, dates, targets, methodology, exclusions, result classification, remediation record, and retest status. A test of a marketing website does not justify a yes for the production SaaS application, APIs, cloud environment, or mobile client.
Keep scanning and pentesting separate
Vulnerability scans and external posture reviews can identify known or observable weaknesses and support ongoing risk management. Penetration testing involves authorized assessment activity within defined rules and may attempt to validate or exploit weaknesses. Describe both, but do not merge the labels.
Share results safely
Offer a customer-safe executive summary or controlled review that includes scope, date, provider, overall outcome, material-risk status, and remediation status. Do not attach exploit details, sensitive architecture, credentials, or a full report to an uncontrolled questionnaire.
Handle a truthful ‘no’
If no relevant pentest has been completed, state that directly. Then describe the vulnerability scanning, code review, dependency management, external monitoring, remediation process, or planned test that actually exists. Any target date and testing frequency should be approved before it becomes a customer commitment.
Choose the accurate questionnaire answer
| Your current state | Recommended answer | Evidence to reference |
|---|---|---|
| Relevant pentest completed and current | Yes—with scope, date, provider, remediation, and exclusions | Customer-safe executive summary or controlled review |
| Only part of the product was tested | Partial—with exact tested and excluded systems | Report scope and remediation record |
| Test is contracted or scheduled | No / planned—use the questionnaire's supported status | Approved engagement status and date, if disclosable |
| Only automated scans are performed | No—then describe scanning separately | Scan scope, cadence, triage, and remediation process |
| No testing or scanning exists | No—record the gap and escalate it | Approved risk treatment or remediation plan, if available |
Answer examples for common states
Replace every bracketed field; never copy a status that is not true
YES: We completed an authorized penetration test of [systems] on [date], performed by [independent provider/internal qualified team] using [methodology]. [Material findings status]. The scope excluded [exclusions]. A customer-safe executive summary is available through our controlled review process.
PARTIAL: We completed penetration testing of [tested systems] on [date]. The engagement did not cover [excluded systems]. Findings are tracked through [process], with [retest/status]. We are not representing the engagement as coverage of the excluded scope.
NO / PLANNED: We have not yet completed a penetration test of [relevant system]. We currently perform [accurate scanning/review practices] and track remediation through [process]. A test is [planned/contracted] for [approved timeframe], but it should not be treated as completed evidence.Recommended workflow
- Read every clause in the question.
- Verify the relevant test scope and date.
- Choose the accurate answer state.
- Add bounded evidence and limitations.
- Have the control owner approve the response.
Use the worksheet
Turn the guide into an owned process.
Open the printable checklist for this topic, assign the missing owners, and record the evidence or decision behind every completed item.
Open printable checklistFrequently asked questions
Can we answer yes if our cloud provider performs pentests?
Not for your own application unless the question specifically asks about the provider. Supplier testing does not automatically cover your code, configuration, APIs, or operating controls.
Is a vulnerability scan a penetration test?
No. They are different assessment techniques. Explain the scan accurately and answer the penetration-test question based on completed testing.
Must we share the full report?
Not automatically. Confirm need, authorization, confidentiality, and sharing controls; a customer-safe summary is often the first appropriate artifact.
Sources and further reading
This guide provides general operational information. It is not legal advice, a certification, or a substitute for a qualified security assessment scoped to your organization.