What to write on the penetration-test row

What the row is asking

An independent penetration test means a tester outside the company tried to break into the product, on a scope you agreed, and wrote a report with a date. The form often says third party. That is the same ask.

A vulnerability scan, a checkbox in a hosting console, and a report about the platform itself are not that test. A test your own engineers ran on a Tuesday is not that test either, unless the form only asked for any test and you say who ran it.

Most forms treat a test in the last 12 months as the current one. If yours is older, or has not happened, the row still has an honest answer.

What reviewers accept

They accept a plain no. If you cannot name the tester, the date, and the report, write that you have not had the test.

A no plus the scanning you actually run is a complete answer when that is all you do. Name how often the scan runs, how soon you fix what it finds, and the date of the last scan.

A test the customer's own team ran can be named, with their name and the date. A report from the company that hosts the product can be named the same way. Say whose report it is, and what it covers. It does not become a test you hired.

A test older than 12 months can be named with that date. Call it the last test, not the current one. If another is scheduled, give the date. If it is not, say it is not scheduled.

An honest no does not force the deal through. It keeps the row true. The answer that fails is one that implies a test you cannot show when they ask for the report.

What not to write

Do not tick yes because a scanner ran. A vulnerability scan is not an independent penetration test.

Do not call a platform or hosting company's report your test. Read the first page. A test of their service is not a test of your application.

Do not call a customer's test your annual test. Say their team ran it, and the date.

Do not call a test older than 12 months current, recent, or annual.

Do not write that a test is scheduled unless a date and a tester exist. A hope is not a date.

Do not attach a sample, a blank template, or another company's report so the row reads as if the test was yours.

Where this answer lives

Keep the sentence in the questionnaire answer you control. The vendor list is a different page. It names the companies that handle customer data.

Trust Prep does not store a penetration-test report, does not fill this row, and does not email anyone.

A company, a location, or an agreement link shows on the public page only after you save it. A penetration-test sentence does not, because there is no field for it.

If you want the longer notes

How to answer the rest of a vendor security questionnaire is in the security questionnaire guide.

What to leave off the public page, including a penetration-test report you cannot keep current, is in the security review guide.

How soon you tell the customer about an incident is a different clock from a test date. What to write on that row is in the incident notification guide.

Where someone sends a vulnerability report, and whether you run a bounty, is a different row from a penetration test and from how soon a scan finding is fixed. What to write is in the vulnerability reporting guide.