Logical access controls
Authentication, authorization, and role boundaries tested against real bypass attempts, not just configuration review.
SOC 2 Compliance
Penetration Testing for SOC 2 Compliance
Manual, developer-ready penetration testing mapped to SOC 2 Trust Services Criteria — built to give your auditor real evidence and your engineering team a report they can act on.
Preparing for a Type I or Type II audit? Tell us your audit window and we’ll scope testing around it.
Scope Call → Manual Testing → Evidence Mapping → Auditor-Ready Report → Retest
SOC 2 Type ISOC 2 Type IITrust Services CriteriaAuditor-Ready Reports
trust_criteria.scan
CC6.1
CC6.6
CC6.7
CC7.1
CC7.2
CC4.1
Confidentiality
Availability
scanning trust services criteria…
Why It Matters
A SOC 2 Report Confirms Controls Exist. A Pentest Confirms They Hold.
SOC 2 doesn’t formally require a penetration test, but most auditors and enterprise security teams expect one as evidence that your access, authentication, and logic controls actually withstand testing — not just that a policy document says they should.
Enterprise Vendor ReviewsAuditor ExpectationsType I ReadinessType II Evidence WindowsControl EffectivenessCustomer Security Questionnaires
Trust Criteria Mapping
Testing Mapped to Trust Services Criteria
Findings are tied directly to the Common Criteria your auditor is evaluating, so your security team can hand over evidence instead of translating a generic pentest report after the fact.
Boundary protection
External-facing APIs and application entry points tested for unauthorized access paths into production systems.
Data transmission & access restriction
Validates that sensitive data in transit and in application responses is restricted to intended users and roles.
Vulnerability detection
Manual identification of exploitable weaknesses across authentication, session handling, and business logic.
Security event monitoring
Confirms whether abuse patterns and access anomalies would be detectable, not just theoretically loggable.
Control monitoring & evaluation
Independent, point-in-time evidence that controls perform as designed — the exact gap auditors flag scanner-only coverage for.
Tenant & customer data isolation
Cross-tenant and cross-account access tested directly, relevant to any SaaS platform under the Confidentiality criterion.
Abuse & resource exhaustion paths
Reviews whether business logic can be abused to degrade service or bypass rate and usage controls.
Engagement Flow
Built Around Your Audit Timeline
Whether you’re preparing for a first Type I report or sit inside an active Type II observation window, testing is scheduled and reported to match what your auditor needs to see and when.
01Scope CallConfirm audit type, systems in scope, and target report date.
02Manual TestingAuthentication, access control, tenant isolation, and business logic testing.
03Exploit ValidationConfirm real reachability and impact, not just theoretical exposure.
04Criteria MappingFindings tied to the relevant Trust Services Criteria.
05Auditor-Ready ReportEvidence formatted for direct auditor and questionnaire use.
06RetestConfirm remediation before your evidence window closes.
Deliverables
What You Hand Your Auditor
A report built to be read by two audiences at once — engineers who need to fix findings, and auditors who need evidence the fixes hold.
Trust Criteria mapping
Every validated finding linked to the specific Common Criteria it relates to.
Reproduction steps
Clear, request-level reproduction detail engineering can act on without back-and-forth.
Business impact summary
Plain-language impact framing your auditor and leadership can both read.
Remediation guidance
Practical fix guidance scoped to your stack, not generic best-practice text.
Retest confirmation
Written confirmation that remediated findings are closed, ready to attach as evidence.
NDA & procurement-ready
NDA available on request, with scoped SOW and secure access coordination for vendor review.
FAQ
SOC 2 Penetration Testing FAQ
Answers for teams evaluating a penetration test ahead of a SOC 2 Type I or Type II audit.
Is a penetration test actually required for SOC 2?
SOC 2 itself doesn’t mandate a pentest by name, but most auditors and enterprise customers expect one as evidence that logical access and application-layer controls hold up under real testing, not just documentation review.
What’s the difference between testing for Type I versus Type II?
A Type I engagement validates controls at a single point in time, ahead of your audit date. A Type II engagement typically needs evidence that controls performed correctly across the observation window, so timing and retesting matter more.
Which Trust Services Criteria does this cover?
Testing is scoped primarily around Security (the Common Criteria, including CC4, CC6, and CC7), with Confidentiality and Availability coverage added when your application or SOC 2 scope calls for it.
Can this replace a vulnerability scan for our audit?
No, and it shouldn’t. Auditors generally want both: automated scanning for baseline coverage, and manual penetration testing for exploitability evidence scanners can’t produce on their own.
Will the report work with our auditor or compliance platform?
Yes. The report is written in plain, evidence-oriented language with reproduction steps and Trust Criteria mapping, so it can be attached directly to your audit evidence without reformatting.
Do you sign an NDA before testing?
Yes, an NDA is available before any scoping details or access are shared, and a scoped SOW is provided ahead of testing.
Next Step
Give your auditor evidence, not assumptions.
Get a manual penetration test scoped around your SOC 2 audit window, mapped to Trust Services Criteria, and reported in a format your auditor can use directly.
Trust Criteria MappingAuditor-Ready ReportsNDA AvailableRetesting Included