security-assessments

name	security-assessments
description	Security assessment and vendor risk management for B2B SaaS — penetration testing, vulnerability scanning, bug bounty programs, security questionnaires (VSAQ/SIG/CAIQ), incident response planning, disaster recovery, and passing enterprise security reviews. Use when responding to vendor security assessments, preparing for enterprise procurement, or building a security program. Triggers on: "security assessment", "penetration test", "bug bounty", "security questionnaire", "VSAQ", "incident response", "vendor review".
license	MIT
compatibility	Claude Code, Jesse, Codex, Hermes, Windsurf, OpenCode, Gemini CLI, Copilot, Zed, VS Code, Goose
metadata	{"version":"1.0.0","author":"LeadMagic","category":"founder-led","tags":["security","pen-testing","bug-bounty","incident-response","security-questionnaire","vsaq","compliance"],"related_skills":["soc2-compliance","data-privacy-compliance","legal-for-founders","vendor-contracts","business-insurance"],"frameworks":["OWASP Top 10 — Web application security risks","NIST Cybersecurity Framework","VSAQ (Vendor Security Assessment Questionnaire) — Google","SIG (Standardized Information Gathering) — Shared Assessments","CAIQ (Consensus Assessments Initiative Questionnaire) — CSA","ISO 27001 — Information Security Management","Vanta Trust Center — Sales handoff methodology","Eunice Buhler (G2) — Sales-legal coordination on vendor risk reviews"]}

Security Assessments

Overview

Every enterprise customer will ask: "Are you secure? Prove it." Your answer cannot be "trust us." It must be: penetration test reports, security questionnaires, incident response plans, and compliance certifications. The mistake: waiting for the first enterprise deal to start thinking about security. By then, it's too late — the security review takes 4-8 weeks and the deal stalls. This skill covers the complete security assessment playbook: penetration testing, vulnerability management, bug bounties, security questionnaires, and incident response.

Authoritative Foundations

• OWASP Top 10 — Web application security risks — Web application security risks
• NIST Cybersecurity Framework — Shapes deliverables for this skill — Every enterprise customer will ask: "Are you secure? Prove it.
• VSAQ (Vendor Security Assessment Questionnaire) — Google — Google
• SIG (Standardized Information Gathering) — Shared Assessments — Shared Assessments
• CAIQ (Consensus Assessments Initiative Questionnaire) — CSA — CSA
• ISO 27001 — Information Security Management — Information Security Management
• Vanta Trust Center — Sales handoff methodology — Sales handoff methodology
• Eunice Buhler (G2) — Sales-legal coordination on vendor risk reviews — Review recency and volume drive Grid placement; ethical ask timing only.

When to Use

Trigger phrases: "security assessment", "penetration test for SaaS", "bug bounty program", "security questionnaire", "VSAQ response", "enterprise security review", "incident response plan", "vulnerability scanning", "vendor security assessment", "pass security review"

Step-by-Step Process

Phase 1: Penetration Testing

What it is: Third-party security experts attempt to hack your application and report vulnerabilities. Not the same as a vulnerability scan. Pen testers think like attackers, chain multiple vulnerabilities, and demonstrate business impact.

When to get one:

• Before first enterprise deal (required by most procurement teams)
• Annually thereafter (most enterprise contracts require annual pen tests)
• After major architectural changes
• After a security incident

Types of pen tests:

Type	What's Tested	When	Cost