What Should Be Included in a SaaS Penetration Testing Scope?

A SaaS company preparing for an enterprise security review may already know that it needs a penetration test.

The harder question is:
What exactly should be included in the penetration testing scope?

A SaaS platform is rarely just a website. It can include customer portals, APIs, administrative panels, authentication systems, multiple user roles, cloud infrastructure, integrations and business critical workflows.

If these components are not considered during scoping, important attack surfaces may remain untested.

A strong SaaS penetration testing scope should therefore reflect how customers, employees, administrators and external systems actually interact with the platform.

The quality of a penetration test depends heavily on what is included in the assessment.

For example, testing only the login page does not provide meaningful coverage if the platform also exposes hundreds of APIs and multiple customer roles.

Similarly, testing a SaaS application without validating tenant isolation can leave a major security risk untested.

The objective of scoping is to answer three questions:
What can an attacker reach?
What can an authenticated user access?
What happens if legitimate functionality is manipulated?

Start with every application that forms part of the customer facing SaaS environment.

Depending on the architecture, this may include:
• Main SaaS application
• Customer portals
• Administrative portals
• Partner portals
• Authentication portals
• Support portals
• Staging environments where authorized
• Mobile application endpoints
• Publicly exposed application interfaces

Subdomains and supporting applications should not automatically be excluded simply because they are not part of the main product interface.

The final scope should identify the exact domains, applications and environments being tested.

https://www.nuagesec.com/services/web-application-security

Yes, when APIs support the SaaS application's functionality, they should be considered during scoping.

Modern SaaS platforms commonly depend on APIs for customer dashboards, mobile applications, integrations, payments, data processing and internal services.

The scope should identify relevant:
• REST APIs
• GraphQL APIs
• SOAP APIs
• Internal APIs
• Partner APIs
• Authentication endpoints
• Administrative endpoints

Testing should consider authentication, authorization, BOLA, sensitive data exposure, rate limiting and business logic.

Leaving APIs outside the scope can create a significant gap between what customers actually use and what the penetration test validates.

https://www.nuagesec.com/api-security-testing-services

Authenticated testing should represent the actual permission model of the SaaS platform.

The scope should identify relevant roles such as:
• Standard customer
• Manager
• Account owner
• Read-only user
• Administrator
• Support user
• Privileged administrator

Where the platform is multi tenant, test accounts should also represent separate customer organizations.

This allows testers to determine whether users can:
• Access unauthorized functions
• Escalate privileges
• Modify another user's resources
• Access another tenant's data
• Bypass role restrictions
• Reach administrative functionality

A SaaS penetration test should validate what each role can actually do, not simply whether users can successfully log in.

Multi tenant isolation should be explicitly considered when multiple customers share the same SaaS platform.

The core security question is:
Can one tenant access another tenant's resources?

Testing may involve:
• Object level authorization
• BOLA
• IDOR
• Role based access controls
• API authorization
• Direct object manipulation
• Cross tenant data access
• Administrative permissions

For example:
Tenant A User → Authenticated Request → Modified Resource ID → Tenant B Data

The penetration test should determine whether application and API controls prevent this type of unauthorized access.

For SaaS businesses serving enterprise customers, tenant isolation can be one of the most commercially important areas to validate.

Authentication should be scoped according to how users access the SaaS platform.

Relevant areas can include:
• Login mechanisms
• Password policies
• Multi factor authentication
• Single sign on
• OAuth
• JWT
• Session management
• Password reset
• Account recovery
• Authentication tokens
• Session invalidation

The objective is not simply to test whether the login page can be attacked.

The assessment should determine whether authentication controls can be bypassed, manipulated or abused to gain unauthorized access.

Yes, especially when the platform contains workflows that directly affect customer accounts, transactions or permissions.

Examples include:
• Subscription upgrades
• Payments
• Refunds
• Discounts
• Usage limits
• Account creation
• User invitations
• Approval workflows
• Data exports
• Role changes

The important question is:
Can a legitimate user manipulate the workflow to perform an action they should not be allowed to perform?

Business logic vulnerabilities often require manual testing because automated scanners cannot understand every application's intended workflow.

This makes business logic an important part of a SaaS focused penetration testing scope.

Cloud infrastructure should be considered when it forms part of the environment being assessed and the engagement permits testing of those assets.

Depending on the architecture, relevant areas may include:
• AWS
• Microsoft Azure
• Google Cloud
• Kubernetes
• Containers
• Storage
• IAM
• Cloud networking
• Databases
• Serverless services

The scope should clearly identify which cloud accounts, environments, services or assets are authorized for testing.

https://www.nuagesec.com/services/cloud-penetration-testing

Before providing a final scope and quotation, a security testing provider should understand the SaaS environment.

Useful information includes:
• Number of applications
• Application URLs
• Number of APIs
• API documentation
• Number of user roles
• Authentication mechanisms
• Number of tenants
• Critical business workflows
• Cloud environment
• Third party integrations
• Testing environment
• Compliance requirements
• Enterprise customer requirements

Providing this information early allows the provider to define a more accurate assessment instead of offering a generic VAPT package.

The scope directly affects penetration testing cost.

A small SaaS application with a single user role and limited functionality requires a different level of effort from a multi tenant SaaS platform with multiple applications, hundreds of APIs, complex authentication and cloud infrastructure.

Pricing can be influenced by:
• Application size
• Number of APIs
• User roles
• Authentication complexity
• Number of environments
• Multi tenant architecture
• Business logic
• Cloud infrastructure
• Testing depth
• Retesting requirements

The right approach is to define the required testing scope first and then compare quotations based on equivalent coverage.

https://www.nuagesec.com/blog/how-to-choose-vapt-company

Avoid vague scope descriptions such as:
“Complete SaaS security testing”

or

“Full application VAPT”

without defining what is actually included.

A useful scope should specify:
• Applications
• URLs
• APIs
• User roles
• Authentication
• Tenant architecture
• Business workflows
• Cloud assets where applicable
• Testing limitations
• Deliverables
• Retesting

A vague scope can create misunderstandings between the SaaS company, security provider and enterprise customer.

Before the assessment begins, confirm:
• Are all customer facing applications included?
• Are relevant APIs included?
• Are authenticated user roles included?
• Will multi tenant isolation be tested?
• Will business logic be assessed?
• Are administrative functions included?
• Are relevant cloud assets included?
• Are enterprise customer requirements covered?
• Is remediation guidance included?
• Is retesting available?

These checks can prevent a common problem:
The penetration test is completed, but the enterprise customer's security team asks for testing that was never included in the original scope.

There is no universal SaaS pentest scope.

The right scope depends on your application's architecture and the way customers interact with it.

For most SaaS platforms, the assessment should consider:
• Web applications
• APIs
• Authentication
• Authorization
• User roles
• Multi tenant isolation
• Business logic
• Administrative interfaces
• Cloud infrastructure where applicable
• Critical integrations

The objective is to test the attack surface that could actually affect your customers and business.

If your SaaS company is preparing for an enterprise security review, customer onboarding or a security assessment, defining the scope correctly is the first step.

A properly scoped penetration test can help identify exploitable weaknesses across applications, APIs, authentication, authorization, tenant isolation and business workflows.

NuageSEC provides VAPT and penetration testing for SaaS platforms, including web applications, APIs, cloud environments and related technology assets.

Instead of selecting a generic VAPT package, define the attack surface first and build the assessment around your actual SaaS environment.

Need help defining the right scope for your SaaS penetration test?

REQUEST A SAAS VAPT SCOPING ASSESSMENT.

https://www.nuagesec.com/contact