Compliance-focused pen testing for SaaS platforms