Investor Due Diligence: Does a UK Climate Tech Company Need a Penetration Test?

No rule names a penetration test for a climate tech company. An investor, grant funder or acquirer is a private party that sets its own conditions, so there is no public instrument to cite. In our experience the request arrives in a due diligence questionnaire or a data room checklist, and it asks for independent evidence that the platform holding your emissions, sensor or compliance data has been tested.

Does an investor’s due diligence require a penetration test?

No law or regulator requires a penetration test because an investor has asked for one. Each investor, grant funder or acquirer writes its own checklist, and the wording differs from deal to deal. What the request means is set by the exact question in front of you, not by a public rule.

Climate tech companies tend to be asked more often than most, for a practical reason. A carbon accounting, ESG reporting or environmental monitoring platform is valued on the trust placed in its data. A buyer or backer who is about to rely on that data wants to know someone independent has tried to break the software that produces it.

There is one legal text that sits behind many of these requests. Your platform holds personal data as well as emissions data: customer contacts, user accounts and often the details of the people who submit or verify figures. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method. See our page on GDPR penetration testing.

The Information Commissioner’s Office explains in its guide to data security that you can undertake this testing through a number of techniques, such as vulnerability scanning and penetration testing. So a penetration test is one accepted way to meet Article 32, and an investor who asks for one is asking for the most direct version of evidence you may owe anyway.

What does an investor actually ask for?

The wording varies, and you should read it before you buy anything. In our experience the ask takes one of four forms, from a general security questionnaire answer up to a named report from a named kind of company. These are habits of buyers and backers, not rules, and no investor is obliged to use any of them.

• A yes or no question. “Have you had an independent penetration test in the last 12 months?” This is the most common form, and it is satisfied by a dated report and a summary of what was fixed.
• A request for the report or a summary. Some deals ask for the full report under a confidentiality agreement. Others accept a summary letter that names the scope, the date and the testing company.
• A named accreditation. The checklist may say the test must come from a CREST-accredited company. If it does, that is the requirement to follow.
• A condition after the deal. A grant or investment may be made on the basis that a test is carried out within a set period, with the findings fixed.

Be careful with the word “audit”. Customers and assessors of a SaaS-style platform also ask about SOC 2 reports and about Cyber Essentials Plus. Those are different pieces of evidence. A penetration test is a hands-on attempt to break your software, and it can be one input to such a report, but it does not replace one.

What is a penetration test, in the investor’s terms?

It is a controlled attempt to breach a system, carried out by a testing company with your permission. The National Cyber Security Centre defines penetration testing as a method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security using the same tools and techniques as an adversary might.

For an investor the useful word is assurance. They cannot read your code or inspect your cloud settings. A test report from an outside company is evidence they can read, with findings scored by severity and a record of what was fixed afterwards.

Who can carry out the test?

No public rule names an accreditation for a test requested in due diligence. Climate tech organisations can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. Start with the document that triggered the request and use the accreditation it names, if it names one.

Where a questionnaire asks for a CREST-accredited test, a CREST-accredited company such as EJN Labs meets it. Where it names a different scheme, use a provider approved for that scheme. If it names nothing, choose a company whose accreditation you can check yourself on the scheme’s own register, and whose testers hold individual certifications.

Ask two practical questions of any company you approach. First, which legal entity holds the accreditation. Second, whether the report will be dated, scoped and scored in a form an investor’s technical adviser can read without a call.

What should a climate tech company test?

Test the systems that produce, carry and protect the data an investor is relying on. That means the reporting portal, the sensor dashboards feeding it, the exchange that passes verified data to auditors and registries, and the boundary between one customer organisation and another. We test your software, not your emissions methodology.

• Carbon reporting and ESG portals. Data entry, calculation-trigger endpoints, report export, and whether one customer can reach another customer’s accounts or reporting periods. See web application penetration testing.
• Sensor and monitoring dashboards. Device enrolment, per-device identity, and whether a spoofed sensor can feed false readings into a compliance report. See IoT penetration testing.
• Compliance data exchange. The APIs and file feeds that carry data to auditors, registries and regulators. See API penetration testing.
• Multi-tenant separation. Row-level security and tenant checks across the app, the API and scheduled reports. See multi-tenant SaaS penetration testing.
• Cloud and perimeter. AWS, Azure and GCP configuration, plus VPN gateways, exposed management interfaces and cloud consoles. See external infrastructure penetration testing.
• Assessor and auditor access. Time-limited verifier accounts, and whether one assessor account can reach another client’s records.

What evidence do you hand back to the investor?

Hand back a dated report that states the scope, the method, each finding with a severity score, and what was fixed. No public rule sets a format for due diligence, so match the evidence to the question. This is practice, not a requirement, and your investor’s adviser may ask for more or less.

For a yes or no question, the useful evidence is the date of the test and confirmation that high and critical findings were fixed, which a retest provides. For a data room, a summary letter naming the scope and the testing company is often enough, with the full report available under a confidentiality agreement. If a deal closes before fixes are finished, a report with an open findings list and a retest date shows a plan, which is better than no report.

Time it before the process starts. A questionnaire that arrives in week one of due diligence is hard to answer if testing has not yet been booked, because scoping, testing, fixing and retesting take weeks. Teams that raise regularly usually keep a current report on file.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for climate tech companies

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated environmental and climate tech service. We test carbon reporting portals, sensor dashboards, compliance data exchanges and the multi-tenant boundary between customers, along with the cloud estate and external perimeter behind them.

The work is done by UK-based, CREST-certified testers. Testing is safe by default on production, with no denial of service, and out of hours slots are available. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing.

Retests are free until findings are resolved, so the evidence you give an investor can show that issues were fixed as well as found. There are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Is a penetration test mandatory to raise investment as a climate tech company?

No rule makes it mandatory. An investor, grant funder or acquirer is a private party that sets its own conditions, so the request depends on the exact wording of the questionnaire or term sheet. UK GDPR Article 32(1)(d) separately requires a process for regularly testing your security measures, without naming penetration testing.

Does a Cyber Essentials certificate replace a penetration test?

No. Cyber Essentials Plus is an assessor-led technical audit of your devices and network settings, and a penetration test is a hands-on attempt to break your software and cloud setup. Some investors accept one, some ask for both. Read the exact wording of the request before you decide.

Does the testing company need to be CREST-accredited?

Only if the requirement says so. Climate tech organisations can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. Check the questionnaire or term sheet that triggered the request and use the accreditation it names.

Do we have to fix every finding before the investor sees the report?

No rule says so, and it depends on the investor. In our experience the report is more useful with the high and critical findings fixed and retested, because that is what the question usually asks. A report with open findings and a dated fix plan is still better than having no report.

Will a penetration test check our emissions calculations?

No. A penetration test looks at the security of your software and the data flows around it. Verifying an emissions methodology or an ESG score sits with your own assurance provider. A test can show whether someone could change or read the figures without permission.

Get a quote for your platform

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Climate Tech Companies, Best Penetration Testing Companies for UK Environmental and Climate Tech, penetration testing for environmental and climate tech, GDPR penetration testing, multi-tenant SaaS penetration testing and IoT penetration testing.