TL;DR: Direct answer: Enterprise procurement teams and vendor risk assessors accept an independent Letter of Attestation detailing scope, methodology, dates, and verified remediation status. Sending your full technical report is a critical liability that exposes unpatched internals. If you have never had a test, scheduling one with confirmed dates and providing a formal statement of work will keep your deal moving.
The Three Things Procurement Checks
When an enterprise buyer stalls a deal demanding proof of an independent penetration test, their security review team is looking for three specific signals:
- Independence: Was the assessment performed by an external, accredited third-party security firm, or was it an internal scan run by your own DevOps team?
- Scope Relevance: Does the tested environment match the exact application, cloud workload, or API endpoints that will process the customer's data? A test of your corporate marketing website does not satisfy a buyer integrating with your production API.
- Remediation Verification: Did a human offensive tester verify that critical and high-severity findings were genuinely fixed, rather than self-certified in a spreadsheet?
Recency is equally critical. Most enterprise vendor risk management (VRM) frameworks mandate that penetration testing must have taken place within the prior 12 months. An engagement completed 14 months ago will almost universally trigger an audit exception unless accompanied by a confirmed upcoming test date.
Why the Letter of Attestation is the Right Artefact
When procurement asks for "your penetration test report," founders and sales executives frequently make the mistake of emailing the entire 45-page technical report. This is almost always a serious mistake.
Full penetration test reports contain detailed, step-by-step exploit chains, proof-of-concept curl commands, internal architectural diagrams, and descriptions of low-severity findings or informational weaknesses that your engineering team may not have patched yet. Circulating that document through an enterprise prospect's shared procurement inbox creates immense legal and operational exposure.
Best Practice: Reputable cybersecurity testing firms issue an official Executive Letter of Attestation. This 2-page document confirms that an independent assessment took place, summarizes the scope and methodology (such as OWASP WSTG and PTES), details the testing dates, and certifies that all vulnerabilities were remediated and verified through a formal retest. This is what enterprise risk teams expect and prefer.
If an enterprise risk analyst insists on seeing technical details, offer to review findings over a confidential, recorded screen-share under NDA, or provide a heavily redacted technical appendix with reproduction steps removed.
What to Do If You Have Never Had a Pentest
If your company has never completed a penetration test and an enterprise customer demands one on a vendor questionnaire, do not panic, and never attempt to pass off an automated vulnerability scan as a pentest.
Enterprise reviewers review dozens of questionnaires weekly. They instantly recognize raw exports from automated scanners like Nessus, Qualys, or Burp Suite. Attempting to present an automated scanner PDF as a comprehensive penetration test immediately signals evasion and will damage the trust of the procurement committee.
Instead, provide a transparent and actionable commitment: "Our annual independent penetration test with Lorikeet Security Canada is scheduled to begin on [Date], with testing executed across our production API and web environments. A Letter of Attestation verifying remediation will be delivered by [Target Date]."
In over 90% of enterprise sales cycles, a signed Statement of Work (SOW) or formal engagement letter with a confirmed testing date is sufficient to allow procurement to sign contracts subject to delivery of the final attestation prior to production deployment.
What a Defensible Attestation Letter Contains
A defensible Letter of Attestation must contain specific data points to pass enterprise scrutiny without back-and-forth email delays:
| Component | What Procurement Looks For | What Red Flags It |
|---|---|---|
| Testing Firm | Independent cybersecurity practice with verified credentials (OSCP, CEH, CREST). | Internal employee signature or unaccredited offshore entity. |
| Fieldwork Window | Exact start and completion dates of active testing (not just the letter issue date). | No dates, or test completed over 12 months prior. |
| Scope Statement | Explicit hostnames, production API versions, role tiers, and multi-tenant isolation. | Vague phrases like "the client's infrastructure" with no defined assets. |
| Methodology | Established offensive standards (OWASP WSTG v4.2, PTES, NIST SP 800-115). | No methodology cited, or listing "OWASP Top 10" as a methodology. |
| Remediation Status | Confirmation that identified critical and high vulnerabilities were retested and resolved. | No mention of remediation or unverified "client reported fixed" claims. |
Closed vs Verified Closed: The Retest Evidence
In enterprise compliance and vendor audits, there is a fundamental distinction between three terms that vendors frequently conflate:
- Remediated: An internal developer claims the bug has been fixed in a pull request.
- Closed: The vendor has marked the Jira ticket as closed and notified the testing firm.
- Verified Closed: A certified penetration tester re-executed the exploit payload against the updated staging/production build and mathematically verified that the vulnerability can no longer be triggered.
Only Verified Closed counts as legitimate audit evidence under SOC 2 Type II, ISO 27001, and enterprise vendor risk assessments. At Lorikeet Security Canada, complimentary retesting is included directly in every flat-rate penetration testing engagement to ensure our clients hold ironclad attestation letters before their audits.
Timing Scoping Against a Live Closing Deal
If you have an enterprise contract slated to close within 3 to 6 weeks, timing is crucial. A typical penetration test requires 3 to 5 business days of active fieldwork, followed by 2 to 3 days for technical report compilation. Your engineering team then requires 5 to 10 days to remediate any critical or high findings before the security firm conducts the formal retest.
Working backwards, you require approximately 3 to 4 weeks from signed engagement letter to holding a clean Letter of Attestation. Scheduling a 20-minute scoping discussion immediately ensures your scope is locked at a guaranteed flat rate without slowing down your revenue timeline.
Frequently Asked Questions
You can, but it is generally discouraged unless strictly required by a tier-one financial institution under a comprehensive mutual NDA. The recommended approach is to provide an independent Executive Letter of Attestation, which proves testing took place and findings were verified fixed without exposing sensitive reproduction commands.
No. Automated scanners only identify known CVEs and basic configuration flags. They cannot test business logic, chaining of low-severity issues into account takeovers, or multi-tenant authorization bypasses. Enterprise risk analysts reject automated scans masquerading as penetration tests.
Attestation letters are standardly valid for 12 months from the date fieldwork concludes, or until a major architectural overhaul takes place (such as migrating to a new identity provider or rewriting the core billing engine).
Need an audit-ready pentest to close an enterprise deal?
Lorikeet Security Canada provides guaranteed flat-rate scoping within 24 hours, rapid test execution, and complimentary retesting with every engagement.
