Security Assessments

Security Assessments

Overview

Every enterprise customer will ask: "Are you secure? Prove it." Your answer cannot be "trust us." It must be: penetration test reports, security questionnaires, incident response plans, and compliance certifications. The mistake: waiting for the first enterprise deal to start thinking about security. By then, it's too late — the security review takes 4-8 weeks and the deal stalls. This skill covers the complete security assessment playbook: penetration testing, vulnerability management, bug bounties, security questionnaires, and incident response.

Authoritative Foundations

• OWASP Top 10 — Web application security risks — Web application security risks
• NIST Cybersecurity Framework — Shapes deliverables for this skill — Every enterprise customer will ask: "Are you secure? Prove it.
• VSAQ (Vendor Security Assessment Questionnaire) — Google — Google
• SIG (Standardized Information Gathering) — Shared Assessments — Shared Assessments
• CAIQ (Consensus Assessments Initiative Questionnaire) — CSA — CSA
• ISO 27001 — Information Security Management — Information Security Management
• Vanta Trust Center — Sales handoff methodology — Sales handoff methodology
• Eunice Buhler (G2) — Sales-legal coordination on vendor risk reviews — Review recency and volume drive Grid placement; ethical ask timing only.

When to Use

Trigger phrases: "security assessment", "penetration test for SaaS", "bug bounty program", "security questionnaire", "VSAQ response", "enterprise security review", "incident response plan", "vulnerability scanning", "vendor security assessment", "pass security review"

Step-by-Step Process

Phase 1: Penetration Testing

What it is: Third-party security experts attempt to hack your application and report vulnerabilities. Not the same as a vulnerability scan. Pen testers think like attackers, chain multiple vulnerabilities, and demonstrate business impact.

When to get one:

• Before first enterprise deal (required by most procurement teams)
• Annually thereafter (most enterprise contracts require annual pen tests)
• After major architectural changes
• After a security incident

Types of pen tests:

How to hire a pen test firm:

• Look for: CREST, OSCP/OSCE certified testers
• Ask: "Show me a sample report." Good reports are detailed, actionable, and prioritize vulnerabilities by severity (CVSS score).
• Red flags: gives a quote without understanding your architecture, promises "100% security," uses only automated scanners
• Recommended: Cobalt, HackerOne, Synack, Bishop Fox, NCC Group, Cure53

What to expect in a pen test report:

• Executive summary (for leadership)
• Technical findings with: CVSS score, steps to reproduce, proof of concept, remediation guidance
• Prioritization: Critical / High / Medium / Low / Informational
• Retest: after fixing, the firm retests to confirm closure

What to do with findings:

1. Critical: fix within 24-72 hours
2. High: fix within 1-2 weeks
3. Medium: fix within 30 days
4. Low/Informational: track in backlog, fix as time allows

Phase 2: Vulnerability Scanning

Continuous scanning (not one-time). Unlike pen tests, vulnerability scans are automated and run regularly.

Tools:

• SAST (static): Snyk, Semgrep, SonarQube — scans your code
• DAST (dynamic): OWASP ZAP, Burp Suite, Detectify — scans your running app
• Dependency: Snyk, Dependabot, npm audit — scans your libraries
• Container: Trivy, Snyk — scans your Docker images
• Infrastructure: AWS Inspector, Prowler, ScoutSuite — scans your cloud

Cadence:

• Dependencies: on every PR (automated in CI)
• Dynamic scanning: weekly
• Infrastructure: monthly
• Full pen test: annually + after major changes

Phase 3: Bug Bounty Program

Bug bounties are NOT a replacement for pen testing. They're a supplement. Pen tests are thorough, methodical, and time-boxed. Bug bounties are crowdsourced, ongoing, and unpredictable.

When to start a bug bounty:

• You've passed at least one pen test (fix the known stuff first)
• You have internal security expertise to triage reports
• You have budget for bounties ($500-5,000 per valid report)
• You have a process for responding to reports (SLA: acknowledge within 24 hours, validate within 7 days)

Platforms:

• HackerOne (most common, enterprise-friendly)
• Bugcrowd (similar to HackerOne)
• Intigriti (European-focused)

Public vs Private:

• Private: invite-only. Lower volume, higher quality. Start here.
• Public: open to anyone. Higher volume, more noise. Scale to this.

Bounty ranges (guidelines):

• Low severity: $100-500
• Medium: $500-1,500
• High: $1,500-5,000
• Critical: $5,000-15,000+

Phase 4: Security Questionnaires

The enterprise gauntlet. Every enterprise customer will send you a security questionnaire — usually a 200-400 question spreadsheet. Your job is to answer it truthfully and route it through your team efficiently.

Common questionnaire formats:

• VSAQ (Google): 50-100 questions, web-based, self-service
• SIG (Shared Assessments): 200-400 questions, spreadsheet
• CAIQ (CSA): 300+ questions, cloud-focused
• Custom: Every enterprise has their own version (sigh)

Strategy:

1. Build a knowledge base of answers. Every question only needs to be answered once. Store answers in a shared doc or tool.
2. Use a tool. SafeBase, SecurityPal, or Vanta can auto-answer 70-80% of standard questionnaires from your security posture data.
3. Route by section. Engineering (app sec, encryption, SDLC), Ops (backup, DR, monitoring), Legal (privacy, data handling, sub-processors), People (background checks, training, offboarding).
4. Be honest. If you don't have something ("no, we don't encrypt data at rest" — you should fix this), say so. Lying on a security questionnaire is fraud and can void your insurance.

Tools for security reviews:

• SafeBase — trust center + auto-answer questionnaires ($)
• SecurityPal — done-for-you questionnaire response ($$)
• Vanta / Drata — compliance automation + questionnaire support ($$$)
• Conveyor — AI-powered security questionnaire response ($)

Phase 5: Incident Response Plan

Every SaaS company needs one. If you don't have an incident response plan when a breach happens, you're making it up in real-time while regulators, customers, and lawyers demand answers.

Incident Response Plan template:

INCIDENT RESPONSE PLAN — [Company]

INCIDENT CLASSIFICATION:
- Sev 1 (Critical): Data breach, system compromise, active attack
- Sev 2 (High): Vulnerability with known exploit, suspicious activity
- Sev 3 (Medium): Policy violation, minor security concern
- Sev 4 (Low): Informational event, false positive

RESPONSE TEAM:
- Incident Commander: [name] — coordinates response
- Technical Lead: [name] — investigates and remediates
- Communications Lead: [name] — internal + external comms
- Legal: [name] — regulatory obligations
- Executive Sponsor: [CEO/CTO]

SEV 1 RESPONSE PLAYBOOK:
T+0-15 min: Detect. Acknowledge alert. Declare incident.
T+15-30 min: Incident Commander assembles response team.
T+30-60 min: Technical Lead begins investigation. Isolate affected systems.
T+1-2 hrs: Determine scope. What data/systems affected? Is attack ongoing?
T+2-4 hrs: Contain. Block attacker access. Preserve evidence.
T+4-24 hrs: Eradicate. Remove attacker presence. Patch vulnerability.
T+24-72 hrs: Recover. Restore systems. Monitor for re-entry.
T+72 hrs: Post-mortem. What happened? What failed? What changes prevent recurrence?

NOTIFICATION OBLIGATIONS:
- GDPR: Supervisory authority within 72 hours
- Customers: "Without undue delay" if high risk
- Cyber insurance: As soon as practical (they provide legal + forensic support)
- Law enforcement: If criminal activity (FBI, local police)

COMMUNICATION TEMPLATES:
- Customer notification: [template — what happened, what data, what we're doing,
  what they should do, contact for questions]
- Internal notification: [template — incident declared, response team activated,
  updates on [Slack channel / email thread], do not discuss externally]

Phase 6: Trust Center

What it is: A public page documenting your security posture for customers and prospects. Shows you take security seriously without requiring an NDA.

What to include:

• SOC2 report (or status if in progress)
• Penetration test summary (not the full report — that's confidential)
• Sub-processor list (who handles customer data)
• Security certifications (SOC2, ISO 27001, GDPR, etc.)
• Encryption details (in transit: TLS 1.2+. At rest: AES-256)
• Uptime and status page
• Vulnerability disclosure policy (how to report a bug)
• Contact: security@[company].com

Tools for trust centers: SafeBase, Conveyor, or custom page.

Output Format

SECURITY PROGRAM — [Company]

PENETRATION TESTING:
- Last test: [date / pending]
- Provider: [firm]
- Next test: [date — annually]
- Findings: [X Critical, Y High, Z Medium, N Low]
- Remediation status: [X% fixed]

VULNERABILITY MANAGEMENT:
- SAST: [tool, cadence]
- DAST: [tool, cadence]
- Dependency: [tool, cadence]

SECURITY QUESTIONNAIRES:
- Knowledge base: [doc link]
- Response tool: [SafeBase / SecurityPal / manual]
- Average response time: [X days]

INCIDENT RESPONSE:
- Plan: [documented / needed]
- Team: [assigned / needed]
- Last tested: [date of last tabletop exercise]

TRUST CENTER: [URL / planned]

Implementation Checklist

• Penetration test completed (web app minimum) — retest confirmed fixes
• Vulnerability scanning automated (SAST + dependency + DAST)
• Bug bounty program launched (private preferred for early stage)
• Security questionnaire knowledge base built (100+ questions answered)
• Incident response plan documented and team assigned
• Trust center published (or SOC2 report available on request)
• Sub-processor list maintained and publicly available
• Annual security review scheduled

Quality Check

Before delivering, verify:

• Output matches the user's stated request
• Named frameworks or sources are reflected in the recommendation
• The deliverable is specific enough for an agent to execute
• Any assumptions, risks, or dependencies are explicit
• No unsupported claims, invented facts, or private/internal references are included

Common Pitfalls

1. No pen test before enterprise deal. Customer asks for pen test report. You don't have one. Deal stalls for 4-6 weeks while you schedule and complete one. Fix: Pen test annually starting from your first mid-market deal.

2. Pen test findings not fixed. You have the report. You never fixed the findings. Next year's pen test finds the same issues. Customer's security team asks why. Fix: Track findings. Fix them. Get retest confirmation.

3. Answering security questionnaires without engineering. "Yes, we encrypt all data at rest" — but your engineering team knows you don't. You just committed to something in a contract. Fix: Route technical questions to the people who know the answers.

4. No incident response plan. Breach happens. Chaos. Everyone's emailing each other. Legal isn't looped in. Customer notification is delayed. Regulatory deadline missed. Fix: Document the plan. Assign the team. Test it with a tabletop exercise.

5. Relying on bug bounties instead of pen tests. Bug bounties catch the obvious stuff and miss the chained vulnerabilities that a methodical pen tester finds. Fix: Pen test annually. Bug bounty as supplement.

⚠️ Disclaimer

This skill provides general informational guidance based on publicly available frameworks and operator experience. It is NOT legal advice, accounting advice, tax advice, financial advice, insurance advice, or professional services advice.

Consult qualified professionals for your specific situation — attorneys for legal/equity matters, CPAs for tax and accounting, licensed brokers for insurance, and certified security assessors for compliance. This skill does not create a professional-client relationship. Use it as a starting point for research and preparation.

Execution Artifacts

• references/framework-notes.md — Named frameworks and reference tables
• templates/output-template.md — Deliverable shell for agent output
• scripts/check-output.py — Lightweight deliverable validator

Related Skills

• soc2-compliance — SOC2 Type II certification
• data-privacy-compliance — GDPR, CCPA, privacy programs
• legal-for-founders — Legal foundations
• vendor-contracts — DPAs, vendor security agreements
• business-insurance — Cyber insurance (requires security program)