Penetration Testing Before Fundraising: What VCs Require
Hisham Mir
July 23, 2026
A penetration test before fundraising is a scoped security assessment run in the weeks before a Series A, B, or growth round to produce the evidence a VC's technical due diligence team will ask for. In 2026 approximately 66% of VCs now conduct cybersecurity due diligence before funding, and Verizon's 2026 DBIR finds 31% of breaches now start with software vulnerabilities. Investors ask for a recent independent pentest report (typically under 18 months old for early stage, under 12 months for later stage), evidence of remediation on critical and high findings, a documented security programme, and increasingly a signed SOC 2 or ISO 27001 attestation. The fastest path to being investor ready is a scoped penetration test delivered in 2 to 3 weeks by a credentialed provider, paired with a verifiable completion certificate the diligence team can authenticate without a phone call.
Across the fundraising support engagements SecurityWall has run for founders preparing for Series A and B rounds, the gaps that surface in the first diligence conversation are almost always the same. The most recent pentest was informal or scanner-generated. Access to production runs through shared credentials the CTO knows about but never had time to fix. There is no documented incident response plan, and if there is one it has not been rehearsed. Cyber insurance was quoted but never bound. The security roadmap referenced in the pitch deck exists as a bullet point, not as a project plan.
None of these are catastrophic. They are operational drift, and every one is fixable. Discovering them in the last week of diligence, though, is the wrong moment. Four to six weeks earlier is the right one.
Fundraising has changed. Where a decade ago Series A diligence covered financials, cap table, product market fit, and management team, in 2026 it also covers security posture. Not because VCs became security experts overnight, but because their limited partners started asking hard questions after portfolio companies took ransomware hits, breach fines, and reputational damage in the first two years post investment. The bar moved down from later stage to Series A, and it is starting to touch seed stage in categories with sensitive data.
This guide covers what security evidence investors actually ask for, what a defensible pentest report looks like in a diligence room, how to time your assessment against the round, what to do if a critical finding lands mid-diligence, and how SecurityWall supports startups through the process with fixed fee engagements, blockchain verifiable certificates, and our SLASH platform for continuous startup security.
Why Investors Now Ask About Security in Diligence
The shift is real, measurable, and driven by portfolio economics. Approximately 66% of VCs now include some form of cybersecurity due diligence in their funding process, and over half of early stage startups experience a cyber incident within the first two years post funding. Verizon's 2026 Data Breach Investigations Report finds that 31% of breaches now start with software vulnerabilities, up materially from prior years. For a fund with 20 to 30 portfolio companies, that is a probabilistic near certainty that one or more will experience a breach in the coming twelve months.
Portfolio protection. VCs increasingly treat security as an asset preservation issue, not a competitive advantage question. A breach at a portfolio company during a growth round can knock 20 to 40% off a valuation, trigger regulatory scrutiny, and delay follow on rounds. Preventing that outcome at the diligence stage is cheaper for the fund than absorbing it later.
Enterprise sales dependency. Most Series A and B rounds are underwritten on projected enterprise sales pipeline. Enterprise buyers apply their own vendor security assessments which stall or kill deals if the security posture is weak. A VC looking at a $50M ARR path sees that pipeline as dependent on the startup being able to clear enterprise procurement, which increasingly requires a current pentest report and framework attestation.
Insurance markets. Cyber insurance underwriters have tightened requirements materially over the past two years. Many now require evidence of penetration testing and remediation before binding coverage. Startups without this evidence pay materially higher premiums, and some categories are becoming uninsurable at reasonable rates. VCs read this as a real cost.
Regulatory exposure. GDPR, PDPL, CCPA, DORA, and NIS2 all now touch startups selling into regulated markets. A breach during the diligence window can convert a portfolio investment into a regulatory case that outlasts the fund's own lifecycle.
Founder distraction. Even without a breach, unresolved security issues consume founder attention at exactly the moment the company should be scaling. VCs know this, and technical diligence is partly a proxy for whether the founder has run a mature enough programme to focus on growth rather than security firefighting.
What Security Evidence VCs Actually Request
The evidence bar rises materially between stages. What passes at seed does not pass at Series B, and what clears Series B does not clear a growth round. The table below is what SecurityWall observes across recent fundraising support engagements.
| Evidence Requested | Series A | Series B | Growth |
|---|---|---|---|
| Independent penetration test report | Preferred | Required | Required |
| SOC 2 Type II or ISO 27001 | In progress OK | Preferred | Required |
| Documented security policies | Required | Required | Required |
| Incident response plan (rehearsed) | Preferred | Required | Required |
| Cyber insurance policy | Preferred | Required | Required |
| Named CISO or security lead | Optional | Preferred | Required |
| Data processing agreement template | Required | Required | Required |
| Continuous security posture evidence | Optional | Preferred | Required |
Patterns observed across recent SecurityWall fundraising support engagements. Individual VC requirements vary; assume the higher bar when preparing.
Most founders discover their pentest evidence is stale or insufficient at the moment the VC's technical diligence team asks for it. That is the wrong moment. Four to six weeks earlier is the right one.
Schedule a Pre Diligence Meeting →What the Pentest Report Must Show for VC Technical Due Diligence
A VC's technical diligence team, sometimes an internal partner and sometimes an external firm the fund retains, reads the pentest report differently from an enterprise security team. They are not looking to catch you out. They are looking to underwrite the risk that comes with the investment. What they want to see is signal that the programme is real.
Recency. A report dated within the last twelve months is safest for Series B and above, eighteen months at the outside for Series A. Anything older than eighteen months is treated as absent regardless of what the report says.
Named credentialed testers. OSCP, OSWE, CREST, CRT, or equivalent verifiable credentials. Anonymous reports get flagged. Diligence teams sometimes phone the testing firm to verify. A pentest firm registered with a national authority reads well because it signals independent oversight.
Blockchain verifiable completion certificate. SecurityWall issues every pentest completion certificate with a blockchain verifiable hash, so a VC diligence team can authenticate the report's provenance and integrity in seconds without a phone call or a verification form. This is meaningful in a diligence room because faked pentest reports are common enough that experienced investors have started asking for provenance evidence. Being able to hand over a certificate the diligence team verifies in one click removes friction and signals operational maturity.
Clear scope definition. What was tested, what was excluded, what assumptions were made, and what the testing window was. Ambiguity here is the first thing a diligence reviewer marks down.
Finding severity distribution and remediation status. A distribution weighted toward low and medium with critical and high findings remediated and retest confirmed reads well. A distribution weighted toward critical and high with no remediation timeline is the finding that stalls the round.
Framework mapping. Findings mapped to SOC 2 Common Criteria, ISO 27001 Annex A, and PCI DSS where applicable. This mapping tells the diligence team you understand what controls the report validates for downstream compliance work.
Executive summary written for leadership. A CISO with 15 minutes should be able to read the executive summary and form a defensible view of your posture. This is the artefact the VC's partner reads.
How to Time Your Pentest Around a Funding Round
Timing matters as much as the underlying testing. The framework below is what SecurityWall recommends across fundraising support engagements.
8 to 12 weeks before term sheet. If you know a raise is on the horizon and your last pentest is more than nine months old, this is the window to run a fresh assessment. It gives you time to remediate critical and high findings, run a retest, and have a clean report ready before diligence starts.
4 to 6 weeks before term sheet. The compressed window. A fresh pentest can still be delivered in 2 to 3 weeks with remediation and retest in the remaining time. Not comfortable, but workable. This is when most founders realise they should have started earlier.
Inside diligence. Not ideal but salvageable. A pentest scoped and delivered in 2 weeks, running in parallel with diligence, with a clear remediation roadmap communicated to the diligence team. Founders who handle this transparently sometimes come out of it stronger because the diligence team sees the security discipline in action.
After term sheet signed. For growth rounds this is often the pattern: term sheet signed subject to satisfactory technical diligence, pentest and remediation completed in the diligence window. Requires clear communication with the fund's diligence team on progress.
Whichever window applies, the sequence stays the same: scope, test, remediate criticals, retest, finalise report, update your data room. Trying to compress by skipping remediation or retest is a false economy because unremediated criticals in a report are worse than no report.
What Happens If You Have a Critical Finding Before the Close
Critical findings surfaced mid-diligence are common. What matters is the response. Diligence teams have seen every category of finding before, and the ones that stall deals are not the findings themselves but the handling.
Do not hide. Attempting to withhold a finding, or scope the pentest to exclude the affected surface, is the fastest way to lose the round. Diligence teams talk. If they discover the omission later, trust breaks and the round follows.
Communicate immediately. Surface the finding to the diligence team the day it is confirmed. Frame it as "found, remediation in flight, retest scheduled." Investors trust founders who lead with transparency.
Have a remediation plan. A finding with a defined remediation owner, timeline, and retest scheduled reads as a mature programme catching an issue. A finding with no plan reads as a broken programme.
Retest and confirm. Once remediated, a documented retest confirming closure is the artefact that closes the item on the diligence tracker. This is why retest inclusion in the original engagement scope matters.
Consider red team validation for material findings. For findings that touch business critical data or systems, a targeted red team follow up demonstrates that the remediation held under adversary conditions. This is the highest signal a founder can produce for a diligence team.
If you cannot confidently answer yes to all six with evidence in the data room, expect follow up cycles that add weeks to the close.
- Do you have an independent penetration test report dated within the last 12 months, authored by named credentialed testers, with a verifiable certificate of completion?
- Are all critical and high findings from the last pentest remediated with retest confirmation?
- Do you have SOC 2 Type II, ISO 27001, or a credible in progress attestation with a signed engagement letter and audit start date?
- Is your incident response plan documented, and has it been exercised in the last 12 months with recorded evidence?
- Do you have a cyber insurance policy bound at a coverage level appropriate to your data and revenue scale?
- Do you have a named security lead accountable for the programme, with a documented reporting line to the CEO or board?
How SecurityWall Supports Startups Through Fundraising
SecurityWall runs fundraising support engagements specifically calibrated to the pace and evidence needs of a live diligence process. Three things make this different from a generic pentest engagement.
SLASH, our startup security platform. SLASH gives founders continuous visibility into their security posture between formal pentest cycles: asset inventory, vulnerability tracking, remediation status, and evidence packaging for future diligence rounds. For a Series A company preparing for Series B in 18 months, SLASH is the operating layer that means the next diligence round takes days rather than weeks.
Blockchain verifiable completion certificates. Every SecurityWall pentest is accompanied by a completion certificate issued with a blockchain verifiable hash. Diligence teams, enterprise buyers, and future investors can authenticate the certificate's provenance and integrity in seconds. This solves a real diligence room problem: faked pentest reports circulate in the market, and experienced diligence teams have started asking for provenance evidence. Being able to hand over a certificate they verify with one click removes friction and signals modern operational discipline.
Direct scheduling, no ticket queue. SecurityWall's contact page has a Schedule Meeting button, not a support form. Founders in an active diligence process do not have time for a two day response cycle on a support ticket. Book a 30 minute call directly with a senior practitioner, get a written scoping document within three days, and start testing inside a week.
Add to that fixed fee pricing, OSCP and CREST credentialed testers, framework mapping to SOC 2 / ISO 27001 / PCI DSS, and retest included as standard, and the engagement is scoped, credentialed, and diligence ready by design.
Frequently Asked Questions
Do VCs require a penetration test? Approximately 66% of VCs in 2026 now include cybersecurity due diligence as part of their process, and a current independent penetration test report is typically the single most requested piece of evidence. Requirements rise materially between stages: Series A treats it as strongly preferred, Series B as required, growth rounds as non negotiable. Categories with sensitive data (fintech, healthtech, defensetech) push the requirement down to seed stage.
When should I get a pentest before a funding round? The ideal window is 8 to 12 weeks before a term sheet, which gives time to test, remediate critical and high findings, run a retest, and finalise a clean report before diligence starts. 4 to 6 weeks is the compressed but workable window with a 2 to 3 week pentest. Running a pentest inside diligence is not ideal but salvageable if handled transparently.
What security documents do investors ask for? The core set: a current independent penetration test report with retest confirmation on critical and high findings, SOC 2 Type II or ISO 27001 attestation (in progress at Series A, delivered at Series B and above), documented security policies, a rehearsed incident response plan, a cyber insurance certificate, a data processing agreement template, and evidence of a named security lead with a reporting line to the CEO or board.
Can I share my pentest report with investors? Yes, and you should. The report is your evidence artefact. A common concern is that sharing findings creates exposure, but modern diligence rooms are covered by NDAs and the report is a snapshot of remediated posture, not open vulnerabilities. Any critical or high findings that were still open at the time of writing should be marked as remediated with retest confirmation before you share.
What if the pentest finds critical vulnerabilities? Communicate immediately to the diligence team, frame the finding as "identified, remediation in flight, retest scheduled," and follow through with a clear timeline. Investors trust founders who lead with transparency. The finding itself rarely stalls a round; the handling does.
How much does startup security diligence cost? For a defensible pentest engagement calibrated to Series A or B diligence, engagements typically run US$5,000 to US$15,000 depending on scope. SecurityWall offers fixed fee engagements with retest included. The comparison point founders miss is that a stalled or lost round costs materially more, and even a 5 to 10% valuation discount on a Series B is usually an order of magnitude larger than the assessment cost.
Related reading:
Tags
About Hisham Mir
Hisham Mir is a cybersecurity professional with 10+ years of hands-on experience and Co-Founder & CTO of SecurityWall. He leads real-world penetration testing and vulnerability research, and is an experienced bug bounty hunter.