Searches every page and blog post. Press Esc to close.

Tech Startups › Product team › Security and Pen Testing

Your security testing, explained in plain English.

Security and penetration testers try to break into your product the way an attacker would, with your permission, so you can fix the weak spots first. They check logins, data access and configuration, then explain the risks and how to fix them.

No tech background needed. This guide explains the role in plain English: what it is, when you need it, what to expect and how to choose the right Volunteer.
A global engine of Volunteer talent, collaborating with ambitious Tech Founders.
70,000+
Volunteers
158+
Countries
225+
Tech startups
6+
Years in operation
In plain English

What does a Security and Pen Tester do for you?

“

Think of a locksmith you invite to test your doors.

Before you move valuables in, you ask an expert to try every lock and window. They show you which ones open too easily, so you can fix them before a burglar finds them.

1

Finds weak spots

Before attackers or customers do.

2

Explains the risk

Which issues matter most and how to fix them, in plain English.

3

Builds trust

Evidence for customers and investors that you take security seriously.

When you need one

Signs it is time to bring one in.

If two or more of these sound familiar, add this role to your Product team.

Bring one in when

  • ✓You store personal, health or financial data
  • ✓You are about to launch or sign a larger customer
  • ✓A customer or investor asks about your security
  • ✓You take payments or handle passwords
  • ✓You have never had an independent security check

You can wait if

  • …You only have designs and nothing is live yet (involve your Solution Architect in security planning instead)
What they own

Four areas a Security and Pen Tester takes off your plate.

01

Application testing

Checking logins, permissions and how data can be reached.

02

Configuration checks

Finding misconfigured servers, storage and services.

03

Risk reports

Clear findings ranked by severity with advice on fixes.

04

Retesting

Confirming fixes actually closed the gaps.

What to expect

Across a 60 Volunteer day term.

Volunteers give up to three hours a day, Monday to Friday, over three months or more. Daily and weekly updates keep you informed, and rapid feedback from you in the first two weeks makes the biggest difference.

1
✦

Weeks 1 and 2

Agrees the written scope and rules of testing with you, then reviews the product and plans the tests.

2
▤

By mid term

A first findings report, ranked by risk, with clear fixes for the engineers.

3
★

By day 60

Fixes retested, a summary you can share with customers and a security checklist for future releases.

Choosing the right Volunteer

What to ask, and what to look for.

You do not need to be an expert to recruit well. Use these questions at interview and listen for the signs below.

Questions to ask

  • ?How would you agree the scope and rules before testing?
  • ?Show me an example findings report (with details removed).
  • ?How do you rank which issues to fix first?
  • ?How do you make sure testing does not disrupt customers?

Good signs

  • ✓Insists on written permission and scope
  • ✓Explains risks without scaremongering
  • ✓Gives practical fixes, not only problems

Red flags

  • ✕Offers to test without written permission
  • ✕Reports hundreds of issues with no priority
  • ✕Shares findings outside your team
Your part as a Tech Founder

Give them this, and they deliver from Day 1.

  • ✓Written permission and a clear scope of what may be tested
  • ✓A test environment where possible
  • ✓An engineer to fix the issues found
  • ✓A safe place to store the findings
  • ✓A signed Volunteer Agreement before they start
FAQ

Questions Tech Founders ask.

Is penetration testing legal? +
Yes, with the owner's written permission and an agreed scope. Never allow testing of systems you do not own, such as third party services, without their permission.
How often should we test? +
Before launch, after major changes and at least once a year. Many teams also run automated security checks on every release.
Do small startups really get attacked? +
Yes. Most attacks are automated and look for common weaknesses, whatever the size of the company.
How much does it cost to recruit this role? +
Volunteers give their time for experience, not pay. You subscribe to the Product plan at £99 a month or £990 a year, which lets you recruit up to 25 Volunteer team members across every role. See the Product plan.
Build it ·
ship it ✦

Ready to recruit your Security and Pen Tester?

Create your company account, list an Opportunity with the matching template and start meeting Volunteers this week.