The email lands on a Tuesday. "We're considering you as a vendor. Please share your latest security testing report." Or a bank asks. Or an investor, before the term sheet. And you realise: you have never had a security test. There is no report. There is no nothing.
First, breathe. This is not a disqualification. It is a procurement question, and it is becoming standard. What matters is what you do next, and most businesses get it right. Here is what the ask actually means, and how to answer it.
What they are really asking for is evidence: that someone independent looked at your systems, found what was wrong, and you fixed it. Nobody expects a report that says "perfectly secure". In fact, a report that found nothing is a report nobody trusts. A real report contains weaknesses. That is the point of it.
A real report has an executive summary, findings with severity ratings and evidence, the business impact of each one, and remediation guidance. If you have never seen one, there is a sample on our site. Reading it takes five minutes, and it makes every future conversation with a client easier.
So how do you get from "never tested" to "report in hand"? Start with the right scope. If you have never been tested, a vulnerability assessment is usually the honest first step: a structured check across your application that produces the report a client wants to see. If the client specifically asks for penetration testing, scope that instead, or run the assessment first and the deeper test after.
Tell the tester what the client is asking for. A good tester will scope the engagement to answer that ask directly, and will tell you honestly if the lighter option is enough. Most businesses go from "no report" to "report shared with the client" within a couple of weeks.
A client asking for a security report is not a threat. It is a business doing its homework, and you get to look like the vendor who did theirs.