A contract requires a pentest before close — who does startup-priced pentests we can reuse?

You are buying a document that a security engineer at your customer will read harder than anything else you send them, because you sell security and they want to know whether your product can take a punch. Buy it for that reader, and it will be reusable for every reader after them.

Reusable means the next buyer accepts it.

You will buy the cheapest test that satisfies this contract, and the next contract will ask again. A report is reusable when it comes from a named independent firm that the buyer's reviewer has heard of or can check, when it is dated within a year, when it covers the product the buyer will actually deploy, when it shows the findings fixed and retested, and when it comes with a summary letter you can hand over before the full report goes out under NDA. Buy those five things once a year and the question stops arriving.

Scope it to what the buyer will deploy.

You scope the test to what the buyer will run, not to your marketing website. That means the agent or the integration that runs inside their environment with their privileges, the control plane you operate, the API between the two, and the authentication and the boundary between tenants. A test of the website reassures nobody who is about to install your agent with root access. Write the scope from the same architecture page you give buyers, the one-page description of what the product touches, what privileges it needs, what data it sees and stores, where it runs, the tenant boundary, how it fails, and what the buyer must run themselves, and the report will describe the thing they are worried about. Say in the scope that the test is authenticated, run against real roles inside the product rather than from outside the login page, because an unauthenticated scan of a login page tells a reviewer nothing, and ask the firm to state its methodology in the report.

The retest letter is what they want.

You will send the report, and what the reviewer wants is the letter. A letter from the firm stating the scope, the dates, the number of findings by severity, and that every high and critical finding was fixed and retested. That letter goes behind the trust center and into your first reply. The full report goes under NDA to the engineer who asks, and the engineer reads the findings before the summary.

A report with no findings is suspicious.

A test that finds nothing is tempting to buy, and a security engineer reads a clean report as a test that did not look. A credible report has findings, shows which ones mattered, and shows them closed. The retest is what turns the findings from a liability into evidence that you fix things, and that is the quality a security buyer is actually buying.

Boutique or platform.

The choice is between a boutique firm with named testers and a testing platform with a pool of them. The boutique gives you a report a reviewer respects and a tester who will argue with your architecture. The platform gives you speed, a portal, and continuous retesting. Neither is wrong. Ask both for a sample report with the client's name removed, and give it to the most skeptical engineer you know. Hire the one whose findings that engineer would have wanted to write. Which firm we would send you to is a pick we have not made.

A scanner is not a test, and neither is a bounty.

A vulnerability scan gets offered as a penetration test, and a bug bounty as a substitute. A scan is evidence that you monitor. A bounty is evidence that you invite research. Neither is an independent test of your deployment surface by a named person, and a reviewer knows the difference at a glance. Run both anyway, because they answer other questions on the form.

Test every year, and on the triggers.

You test once a year, and again when the surface changes: a new agent, a new privilege, a new integration, a major release. And you test again after a peer in your category is breached, because the reviews reopen that week and the first question is whether your test predates the incident.