Does SOC 2 require penetration testing?

SOC 2 does not explicitly mandate penetration testing, but CC7.1 requires evidence of vulnerability identification processes. In practice, auditors expect to see a penetration test report, and most enterprise customers require a clean pen test report as part of their vendor assessment. Annual penetration testing is the accepted standard for SOC 2 Type II compliance.

How often do you need a penetration test for SOC 2?

Annual penetration testing is the standard for SOC 2. Most auditors expect a pen test report that covers the audit period. If your last pen test was more than 12 months ago, plan a new one before fieldwork begins. Some companies test more frequently, particularly after major architectural changes, but annual is sufficient for most SOC 2 audits.

How much does a SOC 2 penetration test cost?

External penetration testing for a typical SaaS application costs $5,000 to $20,000 depending on scope and the testing firm. Web application penetration tests (the most common for SaaS companies) are at the lower end. Infrastructure and network penetration tests add cost. Bug bounty programs through platforms like HackerOne or Bugcrowd can supplement formal testing but are not a substitute.

What should a SOC 2 penetration test report include?

A SOC 2-ready penetration test report should include: scope definition listing the systems tested, methodology (OWASP, PTES, or similar), findings with severity ratings (critical, high, medium, low), evidence screenshots or proof-of-concept, remediation recommendations, and an executive summary. Auditors also want evidence that you remediated critical and high findings, so a retest or remediation tracking record is important.

Can you use an automated scanner instead of a penetration test for SOC 2?

Automated vulnerability scanning (tools like Snyk, Qualys, or AWS Inspector) satisfies part of CC7.1 and should be running continuously in your CI/CD pipeline. However, automated scanning alone is not a substitute for human penetration testing. Auditors and enterprise customers distinguish between automated scanning and manual penetration testing. Both should be in place: scanning for continuous coverage, and a manual pen test annually.

SOC 2 penetration testing: what is required and how to do it right

Penetration testing is one of the most misunderstood SOC 2 requirements. Founders often think any paid security scan satisfies the auditor, then get hit with a finding because the test was the wrong type, the wrong scope, or did not produce the right evidence. This guide walks through what SOC 2 actually demands, what a compliant pen test looks like, and how to budget for it.

SOC 2 pen testing costs $15K on average and is required for CC4.1

What CC7.1 actually requires

CC7.1 sits inside the Trust Services Criteria for system operations. The control text says the entity uses detection and monitoring procedures to identify changes in configurations that result in the introduction of new vulnerabilities, and uses procedures to identify susceptibilities to newly discovered vulnerabilities.

In plain language, CC7.1 requires two distinct activities. First, ongoing vulnerability identification, which auditors expect to see backed by automated scanners running continuously across infrastructure and code. Second, periodic testing by skilled humans who actively try to break the system in ways scanners cannot. That second activity is the penetration test.

Auditors do not just want a passing report. They want evidence that you ran the test, reviewed the findings, and tracked remediations to closure. The remediation tracking is often where companies fail, because they file the report, fix the easy stuff, and forget the medium-severity items that the auditor will absolutely ask about.

Penetration test versus vulnerability scan

These get conflated constantly. They are not the same thing and a vulnerability scan alone does not satisfy CC7.1.

A vulnerability scan is automated. Tools like Nessus, Qualys, or open-source equivalents probe your systems against a database of known vulnerabilities and produce a report. Scans are cheap, run continuously, and catch known issues. They do not exploit anything. They do not chain weaknesses together. They flag potential issues, not confirmed ones.

A penetration test is manual, performed by a credentialed human tester who actively attempts to compromise your system. The tester chains low-severity findings into critical compromises, abuses business logic that scanners cannot understand, and produces a narrative report describing how a real attacker would breach you. Pen tests cost more and happen less often, but they find what scanners cannot.

You need both. Continuous scanning satisfies the ongoing detection portion of CC7.1. The annual or semi-annual pen test satisfies the periodic deep-testing portion.

How often to test

The minimum cadence for SOC 2 is annual. For a Type II audit covering a six- or twelve-month observation window, most experienced auditors prefer to see two tests per year, especially for companies serving regulated industries or handling sensitive customer data. If you only test once and a major release ships mid-window, the auditor may push you to test again before the report can be issued.

A practical rhythm for a growing startup is one full external and web application pen test every twelve months, with a delta test or scoped retest after any major architectural change or new product launch.

Scope decisions

Scope drives both cost and audit coverage. A typical SOC 2 pen test should cover the external perimeter, including all public-facing services and any management interfaces exposed to the internet. The internal network gets tested if you have a corporate network or production environment that an attacker could pivot into after initial compromise. The web application is almost always in scope for SaaS companies, including authentication flows, authorization logic, and any API endpoints customers consume.

If you ship a mobile app, that is a separate engagement. If you have a Kubernetes or container infrastructure that exposes admin surfaces, scope it explicitly. Auditors look at the report and check whether the scope reasonably covers your production system. A pen test that only touches a marketing website while your real product runs on a different domain will not pass review.

What a compliant pen test report includes

The report needs an executive summary suitable for sharing with auditors, customers, and your board. It needs a methodology section that describes what was tested, what was excluded, and what techniques were used. Each finding needs a severity rating using a standard scale such as CVSS, a clear technical description, reproduction steps, business impact, and a recommended remediation.

Crucially, the report needs to identify the tester by name and credentials, list the dates of testing, and be signed or attested by the testing firm. An anonymous PDF from a scanner does not qualify. The auditor wants to see that a real, qualified human did the work.

After remediation, request a retest letter or attestation confirming the critical and high findings have been resolved. This pairing of original report plus retest letter is the gold standard evidence package for CC7.1.

Cost range

Expect to pay between five thousand and thirty thousand dollars for a single engagement. The low end covers a small external perimeter and a basic web app from a junior consultancy. The high end covers a multi-week test across external, internal, and complex application targets from a top-tier firm with senior testers. Most early-stage SaaS companies land between ten thousand and eighteen thousand dollars for their first SOC 2 pen test.

Cheaper providers exist but be cautious. A two thousand dollar pen test is almost certainly an automated scan with a fancy cover page, which the auditor will recognize and reject.

Choosing a tester

Look for OSCP, OSCE, GPEN, or CEH credentials on the testers actually performing the work, not just the firm's leadership. Ask for a sample report with names redacted so you can evaluate quality and depth before signing. Prefer firms that have worked with companies in your industry and at your stage. Ask whether your specific testers will be senior or junior, and whether you can interview them.

Avoid firms that cannot articulate a clear methodology, refuse to share sample reports, or quote a flat low price without scoping conversations.

Turning findings into evidence

Tip

Findings are not failures. Unremediated findings are failures. Set up a remediation tracking workflow where every finding becomes a ticket, gets an owner, gets a target close date, and gets verified after fix. Export this tracking history at audit time alongside the original report and retest letter.

A continuous monitoring approach turns the pen test from an annual fire drill into a routine input to a system that already knows your control posture.

Next steps

Read the full SOC 2 control requirements to see how CC7.1 fits alongside the other Trust Services Criteria, or book a call to have a fractional CISO track your pen test findings to closure as audit-ready evidence.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.