Penetration testing that produces the evidence your SOC 2 auditor expects — mapped to the Trust Services Criteria and aligned to your audit window.
SOC 2 doesn't name penetration testing in a single line item the way PCI does — but auditors and enterprise customers expect a recent third-party pentest as evidence for the Trust Services Criteria around monitoring and vulnerability management.
Pentest evidence supports CC4.1 (monitoring), CC6.1 (logical access), and CC7.1 / CC7.2 (detecting and responding to vulnerabilities).
Annually, aligned to your Type II audit window. Many customers and auditors expect testing within the last 12 months.
B2B SaaS, fintech, and healthtech selling into enterprise — where SOC 2 is a customer-driven requirement, not just an auditor checkbox.
5–10 days · from $15,000 · retests for HIGH and CRITICAL findings included.
We format findings as evidence your auditor can drop straight into the audit — control references, scope, methodology, and retest documentation included.
An executive summary your auditor and customers can read, plus the technical depth your engineers need to remediate.
We schedule around your Type II observation window so the evidence is current when the auditor needs it.
Final scope depends on the number of applications and APIs in scope, your cloud footprint, and your audit timeline. We set final scope and price on a 30-minute call — no obligation.
SOC 2 doesn't mandate it by name, but auditors and enterprise customers expect a recent third-party pentest as evidence for the Trust Services Criteria around vulnerability management and access control. In practice, it's required to pass.
Primarily CC4.1, CC6.1, CC7.1, and CC7.2. We reference the specific criteria each finding supports so your auditor can use the report directly.
Within your Type II observation window, so the evidence is current. Book the scoping call as soon as you know your audit dates.
The number of in-scope applications and APIs, your cloud footprint, and timeline. Engagements start at $15,000.
Book a 30-minute scoping call. We'll confirm scope, timeline, and price — and how the report maps to your SOC 2 requirements.
Book a scoping call