Penetration testing for SOC 2.
Your auditor wants evidence that someone independent tried to break in, and that you fixed what they found. We test by hand, write the report in the shape auditors expect, and retest so the evidence is clean.
Three documents, in the right shape.
SOC 2 doesn't prescribe a penetration test, but auditors expect one as evidence that you find and fix vulnerabilities, usually under the monitoring and system-operations criteria. What they actually read is the paperwork around the test.
A scope statement
Which systems were in scope, which weren't, the test window and the roles we tested with. Written so it matches your system description.
A dated, rated report
Methodology, every finding with severity, proof and a fix, and an executive summary your auditor can quote without reading the rest.
Evidence of remediation
A retest of each fix and an updated report showing what was closed. That is the line auditors look for in a Type II period.
A real test, not a scanner export.
Auditors have seen enough automated reports to know the difference. Ours are manual, role by role, with your business logic in mind, so the findings are the ones that would matter in a breach.
Access control
Authentication, sessions, password reset, MFA, and whether one customer can reach another customer's data.
Business logic
Workflows, approvals, limits and pricing: the flaws that only show once you understand the product.
Injection & APIs
Injection, XSS, SSRF, and the REST or GraphQL layer: tokens, rate limits, mass assignment.
Files & cloud edges
Uploads, storage buckets and the parts of your cloud a web test can reach.
Hardening
Transport security, headers, cookies and the configuration your questionnaire asks about.
Verified fixes
A retest of every finding you fix, so the closing report is evidence, not a promise.
Scope to evidence pack.
Scope call
Twenty minutes on your app, roles, APIs and audit date. You get a fixed quote within one business day.
Test
Certified testers work through the application by hand, usually on a staging copy with test accounts for each role.
Report and debrief
Findings ranked by risk, with reproduction steps and fixes, walked through with your developers.
Retest
Once your fixes are in, we verify each one and issue the updated report and retest letter.
Evidence pack
Scope statement, report and retest letter, named and dated the way your auditor will file them.
75+ engagements, 9 in 10 from people who came back.
Since 2013, across financial technology, enterprise SaaS and AI-enabled platforms. We found and reported critical-severity issues in 10 of 16 representative profiles, and 9 of them included verifying the fixes. See the profiles and a sample report.
Before you book.
Does SOC 2 actually require a penetration test?
Not in so many words. The Trust Services Criteria ask you to identify and address vulnerabilities; auditors treat an independent penetration test as the standard evidence for that, and most enterprise customers' questionnaires ask for one outright. Doing it once a year and after major changes is the usual expectation.
Type I or Type II: when should we test?
For a Type I, before the audit date so the report is in the evidence. For a Type II, inside the observation period, with the retest also inside it, so the auditor sees both the finding and the fix.
Can you test staging instead of production?
Yes, and we prefer it when staging mirrors production. We say which environment was tested in the scope statement, and auditors accept a faithful staging copy.
Will the report make sense to our auditor and our customers?
It is written for both: an executive summary and severity table up front, technical detail behind it. Clients forward it to auditors and enterprise customers as it is.
What do you need from us to start?
Test accounts for each role, the addresses in scope, a contact for questions during the test, and a window when testing won't surprise anyone. That is usually a day of your time, spread over the engagement.
Get secured.
Tell us what you're shipping. You'll get a scoped, fixed quote within one business day.