How to perform a penetration test with Oneleet

Last updated: July 15, 2026

As part of your compliance requirements (SOC 2, ISO 27001, PCI, etc.), you will need to perform a penetration test (pentest) on your application. The pentest is typically included in your compliance package and needs to be performed annually. This article will discuss the process for beginning a pentest with Oneleet.

Scheduling your pentest

To schedule a penetration test, you'll need to go through a scoping call process first.

Here's how to get started:

  1. Navigate to the Penetration tests page from app.oneleet.com.

  2. Click on + Request a pentest in the top-right corner of the page.

  3. Fill out the pop-up form.

  4. Once submitted, a member of our pentest operations team will reach out to schedule a scoping call.

Attend the scoping call

The scoping call is a 30-minute meeting where you'll:

  • Provide a high-level overview of your product

  • Give a demo of your application (the pentester will ask questions during the walkthrough)

    • Additional documentation such as an architecture diagram or API reference is helpful but not required for the scoping call

  • Discuss the testing environment, engagement process, reporting, timeline, retesting, and communication plan

Before the call, prepare answers to these common questions:

  1. Is this your company's first pentest? If not, can you share the previous pentest report?

  2. How many roles does your application have?

  3. Is the application multi-tenant? Does more than one organization use the same instance?

  4. What tech stack is used for the application?

  5. Can you share endpoint descriptions? (API definition, Postman collection, or list of endpoints)

  6. Do you have a staging environment that's representative of production?

Pentest timelines

After the scoping call:

  • Testing can typically start within 1-2 business days

  • A standard compliance pentest consists of 20 hours of testing spread throughout one week

  • The first version of the pentest report will be available within 2 business days after testing finishes

  • Total timeline: approximately 11 days from start to first report