Industries
The obligation differs by industry. So does the scope.
A clinic, a SaaS product, a payments company and an AI agent have different attack surfaces and answer to different obligations. Scoping a test the same way for all four wastes the window.
Health data has a statutory obligation attached to it.
Security testing for clinics, digital health products and custodians handling personal health information under Ontario's PHIPA.
In a multi-tenant product, one finding affects every customer.
Tenant isolation, role boundaries and the SOC 2 timeline. Security testing scoped for a multi-tenant product that ships every week.
Where money moves, the logic is the attack surface.
Where money moves, business logic is the attack surface. Security testing scoped for payment flows and PCI DSS Requirement 11.4.
The model is not your attack surface. The tool list is.
If your product calls tools on a user's behalf, the model is not the attack surface. The permission model is. Testing scoped for AI products.
Next step
Start with a scoping call.
Tell us what you need tested. Before any testing begins, the scope is written down and the agreement and rules of engagement are signed.