SOC 2 Penetration Testing
SOC 2 doesn't name penetration testing as a line-item requirement, but auditors increasingly expect one as evidence for the Security criterion — especially for a Type II report. We scope and document testing so it holds up to auditor review.
Where a penetration test fits into SOC 2
SOC 2 is assessed against the Trust Services Criteria: Security (required for every report), and optionally Availability, Processing Integrity, Confidentiality, and Privacy. Most enterprise customers require a Type II report, which evaluates whether your controls operated effectively over an observation period — not just whether they were designed correctly (Type I).
A penetration test is one of the most common forms of evidence auditors accept for the ongoing vulnerability detection and testing expected under the Security criterion. We structure our engagement and report around what your auditor will actually ask to see.
What we test for SOC 2 readiness
Scope typically covers the systems in your SOC 2 boundary: production infrastructure, customer-facing web applications, and APIs. We align testing to your audit period so the report timing supports your Type II observation window.
Technical depth behind every engagement
Our testers hold certifications including OSCP, OSWP, CRTO, CEH, and AWS Security Specialty, among others. Our in-house team delivers 200+ penetration tests annually across 9+ industry sectors.
A clear process from scope to retest
You know what is happening, who to contact, and when to expect each deliverable.
- 1
Scoping
We confirm targets, objectives, access levels, exclusions, and the compliance requirement the test supports.
- 2
Kickoff & rules of engagement
We agree communications, safety limits, test accounts, escalation contacts, and the incident process before testing begins.
- 3
Testing window
Our specialists combine manual techniques with automated tooling. Critical findings are reported immediately, not held for the final report.
- 4
Written report
Each finding includes evidence, remediation guidance, CVSS scoring, and a real-world exploitability assessment for your environment.
- 5
Follow-up consultation
A free session with our technical team explains the findings, business impact, and practical remediation options.
- 6
Retest
We verify completed fixes and document the result so you can show auditors and stakeholders what changed.
Frequently asked questions
Testing for other frameworks
Get a SOC 2-scoped test
Tell us what is in scope and which audit or business requirement the test needs to support.