CREST pentest
$2,500per application
- Your app, back end and monday integration
- Report in 4–5 working days
- Free retest, attestation letter
monday.com Shield Badge
Readiness & Pentesting
SOC 2, ISO 27001 and GDPR readiness plus a CREST pentest, from one team.
Trusted by teams who ship on deadlines
Only 7% of monday.com Apps
Carry the Shield Badge
We counted every public marketplace listing and its security questionnaire. Most apps leave the Security & Compliance section empty.
91of 1,306apps show the Shield badge
828apps have no security questionnaire on file
18apps report both SOC 2 and ISO 27001
114apps answered “No” to periodic pentesting
Our count from monday’s public marketplace data, 20 Oct 2026. Answers are self-reported by each developer.
Which Shield Route
Fits Your App?
Three questions, about 30 seconds, no email. Your answer appears beside them.
Based on monday’s Shield Badge documentation. Each app is reviewed on its own, and monday can change the routes.
Your route
monday has three routes to the Shield.
- Route 1 · Compliance and certificationsAny hosting. A valid SOC 2 report, an ISO/IEC 27001:2022 certificate and a GDPR attestation.
- Route 2 · Frontend onlyHosted on monday’s infrastructure, and customer data never leaves monday.
- Route 3 · Full stack on monday codeMulti-region deployed to all regions, network allowlist on, customer data kept inside monday.
Answer the questions to see which one fits and what you are missing.
Everything Route 1 Asks For,
From One Team
We get you ready. Independent auditors issue the report and the certificate, and we arrange them.
monday asks for
CyberFortify delivers
A valid SOC 2 report
Issued by an independent CPA firm- Gap assessment and a fix plan against the Trust Services Criteria
- Policies, controls and evidence set up
- The audit firm brought in and the audit run alongside you
An ISO/IEC 27001:2022 certificate
Issued by an accredited certification body- ISMS scope, risk assessment and Statement of Applicability
- Stage 1 and Stage 2 audits arranged with the certification body
A GDPR attestation
Backed by documents you can show- Data map, DPA, subprocessor list and privacy policy reviewed
A periodic pentest
Tested by CREST-accredited engineers- Your app, its back end and the monday integration tested, retest included
- One report for the questionnaire, both audit files and your buyers
An updated security questionnaire
Submitted in the Developer Center- Answers drafted with you, SOC 2 report and ISO certificate ready to upload
Four Steps to Your
Shield Submission
From first call to the badge on your listing.
- 1
Call
Fifteen minutes with Usama.
We confirm your route and give you a fixed pentest price and a Shield Pack quote.
Fixed quote on the call - 2
Test
Pentest and gap assessment side by side.
The AI Pentest Agent covers breadth; accredited engineers exploit and validate every finding. The compliance gap assessment runs at the same time.
Criticals flagged in 24h - 3
Certify
Fix, retest, audit.
You fix with our help, we retest free, and we bring in the SOC 2 auditor and the ISO certification body.
Free retest - 4
Submit
Updated questionnaire, then the badge.
You submit in the Developer Center. monday reviews within 10 business days; an approved badge appears within seven.
Answers drafted with you
Pricing for monday.com
Marketplace Apps
Going for the Shield? Take the Shield Pack. Only need the pentest? The price is below, fixed after a 15-minute scope call.
Shield Pack · for Route 1
Quotedon the call
- SOC 2 and ISO 27001:2022 readiness, auditors arranged
- GDPR documents behind your attestation
- CREST pentest and questionnaire answers included
Every pentest includes
- AI-enabled testing, with every finding validated and exploited by CREST-accredited engineers
- Findings CVSS-scored, with reproduction steps and the fix
- Criticals flagged within 24 hours, not at the end of the engagement
- Free retest of every fix
- Clean report and signed attestation letter for your buyers and auditors
- Professional liability cover and Koop cyber insurance on every engagement
Before you book.
Is the Shield badge required?
No. It is optional, and monday describes the program as a beta that may change. It shows as a shield icon on your marketplace listing. monday says the badge helps apps build trust with enterprise customers, and your approved questionnaire answers appear in the listing’s Security & Compliance section.
What happens on the call?
Fifteen minutes with Usama, the founder. You tell us where your app runs and what you already have. We tell you which Shield route fits, give you a fixed pentest price, and follow up with a Shield Pack quote if you need it. No sales deck.
We’re on monday code. Do we need certification?
Possibly not. Route 3 covers full-stack apps on monday code with multi-region deployed to all regions, the network allowlist active, and no customer data shared outside monday. Route 2 covers frontend-only apps. If you don’t need the Shield Pack, we will say so on the call.
Does monday require a pentest for the Shield?
Not as a Route 1 document. The pentest still matters in three places: the questionnaire asks whether you periodically perform penetration testing, most SOC 2 and ISO 27001 auditors expect an independent test as evidence, and enterprise buyers ask for the report. One pentest covers all three.
Who issues the SOC 2 report and the ISO certificate?
Independent auditors. A CPA firm issues the SOC 2 report and an accredited certification body issues the ISO 27001 certificate. CyberFortify gets you ready and arranges both, so you have one point of contact. monday’s page asks for “a valid SOC 2 report” without naming Type I or II; we recommend one on the call.
How long does it take?
A pentest report takes four to five working days for most apps. The SOC 2 and ISO 27001 timeline depends on what you already have, and we set it on the call. After you submit, monday reviews within 10 business days and an approved badge appears within seven business days.
Does the badge last?
monday reassesses Shield apps every year unless you submit an updated questionnaire sooner, and you resubmit if your data handling, infrastructure or compliance changes. An annual pentest keeps your questionnaire answer current.
Who does the testing, and is it insured?
CREST-accredited engineers led by Usama Gul, CyberFortify’s founder. Our AI Pentest Agent handles breadth; every finding is validated by a human before it reaches your report. Every assignment carries professional liability cover and Koop cyber insurance.
Put the Shield on your listing.
Start with one call.
Book 15 minutes with Usama. You’ll leave knowing your route, with a fixed pentest price and a Shield Pack quote.
monday.com and monday code are trademarks of monday.com Ltd. CyberFortify is an independent vendor and is not endorsed by monday.com.