They asked for a "security test" — what does that actually involve, and what's expected of us?

Filiz S***2 months ago·40 messages·10K views#security testing #audit #contract term #corporate client

Job title: Software developer
Sector: Printing
Organization type: early-stage startup
Joined: Apr 2026
Message: 129

2 months ago#1

We are a 9-person software company developing a cloud-based warehouse and logistics management platform. Last month, we sat down with a major international retail chain and reached the point of signing an annual license agreement worth 520,000 TL. However, their corporate information security department added a clause stating: "Prior to go-live, an independent security testing report must be submitted and all high-risk findings must be resolved."

On the software side, we adhere to standard coding practices, but we've never gone through a formal security testing process before. Once this kicks off, what exactly will the client or their audit team ask from us? Is the test performed on the production server, or do we need to set up a staging environment? Will they review our source code, or just try to breach the system from the outside? I'd really appreciate any guidance from folks who have experience with how this process works and the workload it will demand on our end.

MerveMember

Job title: Operations manager
Organization type: cooperative
Joined: Mar 2024
Message: 118

2 months ago#2

Email your client's information security team immediately and ask for their accepted standard testing methodology and their test scope template. If you get a test done on your own terms, they might reject the report simply because the format doesn't match.

BetülExpert

Job title: Management consultant
Joined: Oct 2023
Message: 164

2 months agoMost Helpful#3

Short answer: The security test your client is requesting is a process where an independent expert firm verifies that your software is secure against data breaches, unauthorized access, and system vulnerabilities. The testing team will probe your system for weaknesses both from the outside like an attacker and from within as an authorized user.

When dealing with large enterprise clients, this request is completely standard because they fear data leaks into their internal networks or having their corporate data stolen through your software. Once the process begins, they'll basically need three things from you: an architectural diagram of the system, access credentials for the test environment, and user role definitions.

The test is strictly never conducted on a production server. Testers bombard the system with heavy traffic, inject special characters into the database, and stress-test workflows; these actions can corrupt live data. That's why you need to set up an identical staging environment populated with sanitized test data or properly masked real data.

To prepare, follow these steps: 1) Provision two test accounts for each user role (e.g., warehouse staff, branch manager, system admin) for the testing firm. 2) Whitelist the testing team's IP addresses on your firewalls and security software so they can run deep scans without getting blocked. 3) Plan for a 1-2 week development sprint once the report comes in so your team can patch the findings; after the fixes are deployed, the test firm will rescan and issue a clean report.

Burcu A***MemberCommunity member

Joined: May 2024
Message: 146

2 months ago#4

Usually they run a "Gray Box" test. They won't ask for source code, but they will want usernames and passwords. The goal is to verify whether a standard warehouse employee can escalate their privileges and access admin-level functions.

Rıdvan B***MemberCommunity member

Joined: May 2023
Message: 180

2 months ago#5

We had a test done for our similarly sized SaaS product last year. It took 5 business days, and they found 1 critical and 3 medium vulnerabilities. Our dev team spent about 25 hours fixing them. Once we handed over the clean report to the client, the contract was signed without a hitch.

Zeynep K***MemberCommunity member

Joined: Feb 2024
Message: 41

2 months ago#6

The client's contract states that the report must come from an independent firm, but did they specify any requirements like TSE accreditation or specific international certifications? If you overlook this the report might be deemed invalid.

Halil K***Member

Job title: Clinic manager
Sector: Seafood
Organization type: medium-sized business
Joined: May 2024
Message: 208

Doki · Interface design · 2026

2 months ago#7

Here's what you need to have ready before testing starts: 1) API documentation or Swagger export, 2) Test environment login URLs and credentials, 3) Phone number of the technical lead who has the authority to halt the test in an emergency.

Ahmet G***MemberCommunity member

Joined: Apr 2022
Message: 30

2 months ago#8

when you spin up the test environment make sure to wipe real customer names and phone numbers. load anonymous data into stagging so that stuff doesn't end up as screenshots in the vulnerability report.

Bora Y***ExpertCommunity member

Joined: Oct 2025
Message: 127

2 months ago#9

Welcome to the enterprise onboarding ritual. Next up after the security test is the 80-question third-party risk assessment questionnaire, grab another cup of coffee.