Who Asks an Adtech or Martech Platform for a Penetration Test, and What Do They Ask For?

No rule names a penetration test for an adtech or martech platform. The ask comes from brand and agency clients running vendor risk reviews, from data partners, and from partner policies, and the wording differs each time. The public law underneath, UK GDPR Article 32 and PECR, does not name a test either, and PECR covers consent for tracking, not security testing.

Does any rule require an adtech or martech platform to have a penetration test?

No rule says so by name. Two public texts touch the sector, and they do different jobs. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures, without naming penetration testing as the method. The Privacy and Electronic Communications Regulations (PECR) govern consent for tracking.

The two are easy to confuse, because a platform that sets cookies, pixels or similar tags sits under both. Regulation 6(1) of PECR says that, subject to its exceptions, a person must not store information or gain access to information stored in the terminal equipment of a subscriber or user. That rule is about permission to track a person’s device. It does not ask anyone to test the platform that does the tracking.

The ICO’s guidance on storage and access technologies includes a section asking whether you need consent for tracking and profiling for online advertising. It is the right place to read about consent. A penetration test answers a different question: could someone who should not have access reach the audience data, the campaign settings or the API tokens behind the consent signal? Our page on GDPR penetration testing covers the data protection side.

Who asks an adtech or martech platform for a penetration test?

In our experience the request comes from three private parties: brand and agency clients, data partners, and the owners of platforms you connect to. None of them is a regulator, so there is no public rule to cite for the ask itself. What you can read is the clause in the contract, the questionnaire or the partner terms that triggered it.

Brand and agency clients. A brand that uploads its customer lists or lets you place tags on its site is usually the controller of that data. Where your platform acts as its processor, UK GDPR Article 28(3)(h) requires the contract to oblige the processor to allow for and contribute to audits, including inspections, conducted by the controller or an auditor it mandates. That clause is why a brand’s procurement or data protection team feels entitled to ask for security evidence, and the test report is a common way to give it.

Data partners. Where audience, measurement or identity data is shared between companies, the data-sharing agreement usually sets out security expectations. In our experience these differ widely, and some ask for a recent independent penetration test of the systems that receive the data. Read the agreement for the exact wording rather than assuming a standard.

Platform and partner policies. Advertising and marketing platforms publish partner terms for companies that connect to them through integrations. We do not cite a specific platform policy here, because they change and each has its own wording. If a partner programme asks for security evidence, the programme’s own current terms are the source.

What do brand and agency clients actually ask for?

In our experience, an enterprise brand’s vendor risk assessment asks for independent security testing evidence, sometimes alongside a SOC 2 Type II report. SOC 2 does not itself mandate a penetration test, so this is a buyer expectation rather than a named legal requirement. The questions are shaped by what a brand stands to lose if your platform is breached.

• Can one brand or agency client reach another’s audience segments, campaign data or API credentials?
• Can a user change budgets or spend caps without permission, or see campaigns they do not own?
• Could a compromised or injected tag take visitor or customer data off a client’s site?
• Are marketing lists, segment exports and contact records protected from other accounts?
• Are the APIs that feed exchanges, demand-side and supply-side platforms and measurement partners tested for object-level authorisation and quota abuse?

Keep the wording of each request. A brand that asks about tenant isolation needs a different scope from a data partner that asks about the cloud store receiving its feed.

Who can carry out the test for an adtech or martech platform?

No brand clause, UK GDPR article or PECR regulation names an accreditation. Adtech and martech organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Start with the document that triggered the request and use the accreditation it names.

CHECK is the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and critical national infrastructure systems and networks. In our experience a brand client rarely names it, but a public sector client of an agency might. Where a request asks for a CREST-accredited penetration test, a CREST-accredited company such as EJN Labs meets it.

What should an adtech or martech platform test?

Test the places where one client’s data could reach another, then the places where data leaves your platform. A typical stack has around eight systems, from campaign managers and customer data platforms to the APIs that move data to exchanges, clean rooms and measurement partners. Our adtech and martech page lists each.

• Customer data platforms and client isolation. Audience segments, pixels and API tokens shared across brand and agency clients on one platform.
• Campaign managers and ad-serving. Budget and spend-cap tampering, campaign-to-campaign leakage, and role separation between agency, brand and publisher users.
• Tag management, pixels and consent management. Unauthorised tag injection, pixel governance and whether a compromised tag could take visitor data from a client’s site.
• Marketing automation and list management. Marketing-list exposure, contact-record IDOR and segment-export controls.
• Bidstream, DSP and SSP integrations. The APIs behind programmatic bidding and third-party data feeds. See API penetration testing.
• Cloud stores for audience and measurement data. IAM scoping, encryption at rest and tenant boundaries in shared warehouses and clean-room environments.
• Corporate and agency networks. Segregation between creative, media-buying and finance teams, and access to ad accounts and billing.

What evidence do you hand back to a brand client or data partner?

Hand back a dated report that states the scope, the method, each finding with a severity score and what was fixed. No public rule sets a format for adtech or martech vendors, so match the evidence to the question. A brand’s vendor assessment and a data partner’s agreement usually want different levels of detail.

For a brand’s vendor assessment, the useful items are the scope, the date, the testing company and confirmation that high and critical findings were retested. For a data partner, the useful item is evidence about the specific system that receives or sends the shared data. A letter of attestation can sit in an enterprise vendor assessment or a SOC 2 evidence pack, with the full report available under a confidentiality agreement.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for adtech and martech platforms

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated advertising and marketing technology service. We test with client isolation in mind: customer data platforms, campaign managers, tag and pixel layers, marketing automation, bidstream APIs and the cloud stores behind them.

Testing runs against non-production environments with synthetic audience and campaign data wherever possible. The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Does PECR require a penetration test?

No. Regulation 6(1) of PECR is about storing information on, or accessing information stored on, a person’s device, and it does not mention penetration testing. UK GDPR Article 32(1)(d) requires a process for regularly testing the effectiveness of your security measures, without naming a method.

Can a brand client audit an adtech vendor?

Where the platform is the brand’s processor, UK GDPR Article 28(3)(h) requires the contract to oblige the processor to allow for and contribute to audits, including inspections, conducted by the controller. Read your contract for how that works. Many vendors satisfy the clause with a penetration test report.

Should the consent management platform be tested?

Test it as part of the tag and pixel layer. A penetration test does not review your legal basis for consent, which is a separate review. It checks whether tags can be injected without authorisation and whether a compromised tag could take visitor data from a client’s site.

Can testing avoid disturbing live campaigns and ad spend?

Yes. EJN Labs tests non-production environments with synthetic audience and campaign data wherever possible, and testing is safe by default on production, with no denial of service. Tell the testing company about launch dates and peak trading periods when you ask for the quote.

Does the testing company need to be CREST-accredited or a CHECK provider?

No brand clause, UK GDPR article or PECR regulation names an accreditation. Adtech and martech organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Use the accreditation named in the client or partner document that triggered the request.

Get a quote for your platform

Tell us which systems are in scope and which client or partner asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Adtech and Martech Platforms, Best Penetration Testing Companies for UK Adtech and Martech, penetration testing for adtech and martech, GDPR penetration testing, API penetration testing and multi-tenant SaaS penetration testing.