If your app must undergo penetration testing, where this is not part of your security activities, penetration testing can be completed under the Microsoft 365 Certification and is FREE. The scope of penetration testing is limited to the App and the supporting infrastructure that is in scope for the Microsoft 365 Certification.