When a Vietnam Dedicated Team Needs a Pentest Before a Customer Security Review
TL;DR: Book a pentest when a customer's security review asks what you tested on the product. For a Vietnam dedicated team that usually means one named host, and a separate test if you ship an AI agent. Reviewers recognise a findings report, a signed attestation letter, a debrief, and a retest of fixes. The letter is not a SOC 2 or ISO certificate. Observ publishes that scoped offer. The dedicated team matters because it can still fix findings inside the retest window.
Last updated 26 October 2026. This sits next to security, IP, and Privacy Act essentials and the complete guide to offshore dedicated teams. Contract execution is a different packet: IP assignment, NDAs, and MSAs.
When should you book a pentest, rather than start a certification?
Book the pentest when a customer, insurer, or auditor asks what you tested on a named system, and when. Do not start with a company-wide SOC 2 or ISO 27001 program if the questionnaire is about one product a Vietnam pod just shipped.
The usual trigger is a security review after a pilot, not a logo on the partner's website. The reviewer wants evidence they can file: scope, dates, findings, and a letter. A vulnerability scan with no person behind it rarely survives that desk. A dedicated team still helps, because the same engineers who built the host are the ones who will patch it. The test itself is a separate purchase from the pod.
Is the scope one host, or the AI agent as well?
One host is one hostname and port you name, such as a web app or an API. An AI agent is a different test. Prompt injection, tool misuse, and data the agent should not hand out are not covered by pointing a web-app test at the same domain.
| What the customer asked | Book this | Honest limit |
|---|---|---|
| Test this web app or API | One host pentest | A second host is a second test. A network scan is not a substitute. |
| Test the agent | A separate AI agent pentest | Best for products that take prompts, call tools, or return customer data. A host test does not cover that. |
| Certify the company | SOC 2 or ISO 27001 with an accredited auditor | An attestation letter is not that certificate. Budget a different timeline. |
If the pod is building both the app and the agent, buy both scopes. Teams that only test the website, then tell the reviewer "we pentested", fail the follow-up question about the agent. Composition for that pod is in AI and ML dedicated teams for Australian buyers.
What paperwork does a customer security review actually accept?
Reviewers usually accept four artefacts from a scoped test: an executive summary, technical findings ranked by CVSS with evidence and a fix, a debrief your engineers attended, and a signed attestation letter stating what was tested, when, and the result.
Observ publishes that packet for one host and for one AI agent: the report, the letter, a debrief, and one retest inside 90 days. A person on their team reviews each finding before the report ships. Observ is the pentesting service of Cipher Projects, founded in Canberra in 2023. Use the letter with your auditor or the customer's security team. Observ states it is not a SOC 2 or ISO 27001 auditor, and the letter is not a certification.
- Rules of engagement and an NDA, signed before anyone tests.
- Testing that follows OWASP guidance and stays inside the host you named.
- A retest that marks each fixed finding closed or still open. It is not a second full test.
The dedicated-team advantage is the retest, not a day rate. Findings land, and an exclusive Vietnam pod is still on your backlog, so the 90-day window is a sprint. A project agency has often rolled off by then, and the retest becomes a new statement of work.
What do published pentest prices look like in 2026?
Several firms now print a range. Treat each figure as that firm's published price on the date below. They are not one rate card, and they are not a quote for your app. Currencies differ.
| Publisher | What they price | Figure they publish |
|---|---|---|
| Siege Cyber | Web application and API, excluding GST. Report, debrief, and retest included. Page dated 18 October 2026. | A$5,900 to A$16,500 |
| Penva Security | Web application. Page dated May 2026. They also describe a typical SaaS plus API plus cloud test around A$8,000 to A$15,000. | A$3,000 to A$15,000 |
| Ironbark Cyber | Focused single-application test, often 5 to 10 testing days. Their page does not date the range. | A$8,000 to A$18,000 |
| Observ | One host, or one AI agent. Report, attestation letter, debrief, and one retest inside 90 days. Retrieved 26 October 2026. Price cards are US dollars in the page schema. | US$3,995 per host. US$5,995 per agent. |
A US$3,995 host test is one hostname and port. It is not a multi-role SaaS program, and it is not the A$8,000 to A$18,000 band firms publish for a larger application. If your product has many roles, tenants, or a second host, expect a larger scope. Read each firm's page before you compare. None of these numbers is a Cipher or Observ quote for a team you have not scoped.
Why does the retest window suit a Vietnam dedicated team?
The report is useful only if someone still employed on your backlog can patch it. Dedicated means those engineers are exclusive to you across the quarter, including the weeks after the findings arrive.
Observ's published timeline is a start within 10 business days of a signed scope, then a report within 5 business days of testing. The retest, if you ask inside 90 days, checks the fixes from that report. Vietnam is typically about 3 hours behind AEST, so the debrief can sit in the overlap: Australian product owner on the call, the pod already looking at the same findings. Playbook context: how Australian companies build Vietnam engineering teams.
Book staging when you can. Observ will test production if you schedule a window or sign an acceptance of production risk, and it turns down a production host with no window. The Vietnam pod should have a non-production host ready before you ask for dates. Day-one access rules for that host are in the security guide linked above.
What should you refuse, and what will a serious tester refuse?
A real test starts with written authorisation for a host you control. Observ publishes the gate in plain language: no written authorisation, no start; no test of a third party you do not control; no exploit code and no weaponized payload. Each finding should include evidence your team can reproduce, and the fix.
- Your authorised officer signs the scope. The engineers in Da Nang or Ho Chi Minh City do not authorise a test of a customer or a vendor.
- Ask for the attestation letter in the same engagement as the report. Buying a PDF of findings with no letter leaves the reviewer short.
- Do not treat the letter as Essential Eight, SOC 2, or ISO evidence. It answers a narrower question: this host, these dates, these results.
The pod that can still patch
If you want an exclusive Vietnam team under Australian leadership, and you already know a customer review is coming, Cipher Projects can walk through composition. Booking the test itself is a separate scope on Observ.
FAQ
Is a vulnerability scan enough for a customer security review?
A scanner report is usually not what the reviewer asked for. They want a person to have tested the host or the agent, a CVSS-ranked finding with evidence and a fix, and a signed letter saying what was tested and when.
Does one host pentest cover our AI agent?
No. A host pentest covers the hostname and port you name, such as the web app or API. Prompt injection, tool misuse, and data the agent should not hand out are a separate test.
Is the attestation letter a SOC 2 or ISO 27001 certificate?
No. The letter states what was tested, when, and the results. You can hand it to an auditor or a customer's security review. It is not a certification, and the tester is not your SOC 2 or ISO auditor.
Who signs the rules of engagement if the engineers are in Vietnam?
An authorised officer of the Australian company that owns the host. The Vietnam pod can prepare a staging environment and join the debrief. They should not authorise a test of a system the company does not control.
Is Observ the same business as the dedicated team?
Observ is the pentesting service of Cipher Projects. Cipher's offshore dedicated teams page is the conversation about an exclusive Vietnam pod. Booking a test on Observ is a separate scope. This page is education, not a quote.
Key Takeaways
- Book a pentest when the review asks what you tested on the product. A certification is a different project.
- One host and one AI agent are two scopes. Do not answer an agent question with a website test.
- The packet is a CVSS report, a debrief, a signed attestation letter, and a retest of fixes.
- Published 2026 ranges are in different currencies. Observ's host price is US$3,995 for one host, not a multi-role SaaS quote.
- An exclusive Vietnam team can patch inside the retest window. The letter is still not a SOC 2 or ISO certificate.