Security assessment and vendor risk management for B2B SaaS — penetration testing, vulnerability scanning, bug bounty programs, security questionnaires (VSAQ/SIG/CAIQ), incident response planning, disaster recovery, and passing enterprise security reviews. Use when responding to vendor security assessments, preparing for enterprise procurement, or building a security program. Triggers on: "security assessment", "penetration test", "bug bounty", "security questionnaire", "VSAQ", "incident response", "vendor review".
license
MIT
compatibility
Claude Code, Jesse, Codex, Hermes, Windsurf, OpenCode, Gemini CLI, Copilot, Zed, VS Code, Goose
metadata
{"version":"1.0.0","author":"LeadMagic","category":"founder-led","tags":["security","pen-testing","bug-bounty","incident-response","security-questionnaire","vsaq","compliance"],"related_skills":["soc2-compliance","data-privacy-compliance","legal-for-founders","vendor-contracts","business-insurance"],"frameworks":["OWASP Top 10 — Web application security risks","NIST Cybersecurity Framework","VSAQ (Vendor Security Assessment Questionnaire) — Google","SIG (Standardized Information Gathering) — Shared Assessments","CAIQ (Consensus Assessments Initiative Questionnaire) — CSA","ISO 27001 — Information Security Management","Vanta Trust Center — Sales handoff methodology","Eunice Buhler (G2) — Sales-legal coordination on vendor risk reviews"]}
Security Assessments
Overview
Every enterprise customer will ask: "Are you secure? Prove it." Your answer
cannot be "trust us." It must be: penetration test reports, security
questionnaires, incident response plans, and compliance certifications.
The mistake: waiting for the first enterprise deal to start thinking about
security. By then, it's too late — the security review takes 4-8 weeks
and the deal stalls. This skill covers the complete security assessment
playbook: penetration testing, vulnerability management, bug bounties,
security questionnaires, and incident response.
Authoritative Foundations
OWASP Top 10 — Web application security risks — Web application security risks
NIST Cybersecurity Framework — Shapes deliverables for this skill — Every enterprise customer will ask: "Are you secure? Prove it.
VSAQ (Vendor Security Assessment Questionnaire) — Google — Google
SIG (Standardized Information Gathering) — Shared Assessments — Shared Assessments
What it is: Third-party security experts attempt to hack your application
and report vulnerabilities. Not the same as a vulnerability scan. Pen testers
think like attackers, chain multiple vulnerabilities, and demonstrate
business impact.
When to get one:
Before first enterprise deal (required by most procurement teams)
Dependency: Snyk, Dependabot, npm audit — scans your libraries
Container: Trivy, Snyk — scans your Docker images
Infrastructure: AWS Inspector, Prowler, ScoutSuite — scans your cloud
Cadence:
Dependencies: on every PR (automated in CI)
Dynamic scanning: weekly
Infrastructure: monthly
Full pen test: annually + after major changes
Phase 3: Bug Bounty Program
Bug bounties are NOT a replacement for pen testing. They're a supplement.
Pen tests are thorough, methodical, and time-boxed. Bug bounties are
crowdsourced, ongoing, and unpredictable.
When to start a bug bounty:
You've passed at least one pen test (fix the known stuff first)
You have internal security expertise to triage reports
You have budget for bounties ($500-5,000 per valid report)
You have a process for responding to reports (SLA: acknowledge within 24
hours, validate within 7 days)
Public: open to anyone. Higher volume, more noise. Scale to this.
Bounty ranges (guidelines):
Low severity: $100-500
Medium: $500-1,500
High: $1,500-5,000
Critical: $5,000-15,000+
Phase 4: Security Questionnaires
The enterprise gauntlet. Every enterprise customer will send you a security
questionnaire — usually a 200-400 question spreadsheet. Your job is to answer
it truthfully and route it through your team efficiently.
SIG (Shared Assessments): 200-400 questions, spreadsheet
CAIQ (CSA): 300+ questions, cloud-focused
Custom: Every enterprise has their own version (sigh)
Strategy:
Build a knowledge base of answers. Every question only needs to be
answered once. Store answers in a shared doc or tool.
Use a tool. SafeBase, SecurityPal, or Vanta can auto-answer 70-80% of
standard questionnaires from your security posture data.
Route by section. Engineering (app sec, encryption, SDLC), Ops (backup,
DR, monitoring), Legal (privacy, data handling, sub-processors), People
(background checks, training, offboarding).
Be honest. If you don't have something ("no, we don't encrypt data at
rest" — you should fix this), say so. Lying on a security questionnaire is
fraud and can void your insurance.
Tools for security reviews:
SafeBase — trust center + auto-answer questionnaires ($)
Every SaaS company needs one. If you don't have an incident response plan
when a breach happens, you're making it up in real-time while regulators,
customers, and lawyers demand answers.
Incident Response Plan template:
INCIDENT RESPONSE PLAN — [Company]
INCIDENT CLASSIFICATION:
- Sev 1 (Critical): Data breach, system compromise, active attack
- Sev 2 (High): Vulnerability with known exploit, suspicious activity
- Sev 3 (Medium): Policy violation, minor security concern
- Sev 4 (Low): Informational event, false positive
RESPONSE TEAM:
- Incident Commander: [name] — coordinates response
- Technical Lead: [name] — investigates and remediates
- Communications Lead: [name] — internal + external comms
- Legal: [name] — regulatory obligations
- Executive Sponsor: [CEO/CTO]
SEV 1 RESPONSE PLAYBOOK:
T+0-15 min: Detect. Acknowledge alert. Declare incident.
T+15-30 min: Incident Commander assembles response team.
T+30-60 min: Technical Lead begins investigation. Isolate affected systems.
T+1-2 hrs: Determine scope. What data/systems affected? Is attack ongoing?
T+2-4 hrs: Contain. Block attacker access. Preserve evidence.
T+4-24 hrs: Eradicate. Remove attacker presence. Patch vulnerability.
T+24-72 hrs: Recover. Restore systems. Monitor for re-entry.
T+72 hrs: Post-mortem. What happened? What failed? What changes prevent recurrence?
NOTIFICATION OBLIGATIONS:
- GDPR: Supervisory authority within 72 hours
- Customers: "Without undue delay" if high risk
- Cyber insurance: As soon as practical (they provide legal + forensic support)
- Law enforcement: If criminal activity (FBI, local police)
COMMUNICATION TEMPLATES:
- Customer notification: [template — what happened, what data, what we're doing,
what they should do, contact for questions]
- Internal notification: [template — incident declared, response team activated,
updates on [Slack channel / email thread], do not discuss externally]
Phase 6: Trust Center
What it is: A public page documenting your security posture for customers
and prospects. Shows you take security seriously without requiring an NDA.
What to include:
SOC2 report (or status if in progress)
Penetration test summary (not the full report — that's confidential)
Sub-processor list (who handles customer data)
Security certifications (SOC2, ISO 27001, GDPR, etc.)
Encryption details (in transit: TLS 1.2+. At rest: AES-256)
Uptime and status page
Vulnerability disclosure policy (how to report a bug)
Contact: security@[company].com
Tools for trust centers: SafeBase, Conveyor, or custom page.
Output Format
SECURITY PROGRAM — [Company]
PENETRATION TESTING:
- Last test: [date / pending]
- Provider: [firm]
- Next test: [date — annually]
- Findings: [X Critical, Y High, Z Medium, N Low]
- Remediation status: [X% fixed]
VULNERABILITY MANAGEMENT:
- SAST: [tool, cadence]
- DAST: [tool, cadence]
- Dependency: [tool, cadence]
SECURITY QUESTIONNAIRES:
- Knowledge base: [doc link]
- Response tool: [SafeBase / SecurityPal / manual]
- Average response time: [X days]
INCIDENT RESPONSE:
- Plan: [documented / needed]
- Team: [assigned / needed]
- Last tested: [date of last tabletop exercise]
TRUST CENTER: [URL / planned]
Implementation Checklist
Penetration test completed (web app minimum) — retest confirmed fixes
Bug bounty program launched (private preferred for early stage)
Security questionnaire knowledge base built (100+ questions answered)
Incident response plan documented and team assigned
Trust center published (or SOC2 report available on request)
Sub-processor list maintained and publicly available
Annual security review scheduled
Quality Check
Before delivering, verify:
Output matches the user's stated request
Named frameworks or sources are reflected in the recommendation
The deliverable is specific enough for an agent to execute
Any assumptions, risks, or dependencies are explicit
No unsupported claims, invented facts, or private/internal references are included
Common Pitfalls
No pen test before enterprise deal. Customer asks for pen test report.
You don't have one. Deal stalls for 4-6 weeks while you schedule and
complete one. Fix: Pen test annually starting from your first mid-market
deal.
Pen test findings not fixed. You have the report. You never fixed the
findings. Next year's pen test finds the same issues. Customer's security
team asks why. Fix: Track findings. Fix them. Get retest confirmation.
Answering security questionnaires without engineering. "Yes, we encrypt
all data at rest" — but your engineering team knows you don't. You just
committed to something in a contract. Fix: Route technical questions to
the people who know the answers.
No incident response plan. Breach happens. Chaos. Everyone's emailing
each other. Legal isn't looped in. Customer notification is delayed.
Regulatory deadline missed. Fix: Document the plan. Assign the team. Test
it with a tabletop exercise.
Relying on bug bounties instead of pen tests. Bug bounties catch the
obvious stuff and miss the chained vulnerabilities that a methodical pen
tester finds. Fix: Pen test annually. Bug bounty as supplement.
⚠️ Disclaimer
This skill provides general informational guidance based on publicly available frameworks and operator experience. It is NOT legal advice, accounting advice, tax advice, financial advice, insurance advice, or professional services advice.
Consult qualified professionals for your specific situation — attorneys for legal/equity matters, CPAs for tax and accounting, licensed brokers for insurance, and certified security assessors for compliance. This skill does not create a professional-client relationship. Use it as a starting point for research and preparation.
Execution Artifacts
references/framework-notes.md — Named frameworks and reference tables
templates/output-template.md — Deliverable shell for agent output
