SOC 2 penetration testing is not a formal requirement. The AICPA Trust Services Criteria name penetration testing once, as a point of focus under CC4.1, among the evaluations management may use. In practice, most auditors and enterprise buyers expect an annual, independent, human-led test of the systems inside your SOC 2 boundary, with retest evidence.
This guide to SOC 2 penetration testing covers what the criteria actually say, what to put in scope, when to test, what the report needs, what a SOC 2 pentest costs, and how to choose a firm without overpaying for your first audit.
Does SOC 2 require a penetration test?
No criterion requires one. CC4.1 asks management to select, develop and perform ongoing and/or separate evaluations of whether controls are present and functioning. One of its points of focus reads: management uses “a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments.”
Points of focus illustrate how a criterion can be met; they are not mandatory. Vulnerability scanning appears separately, as a point of focus under CC7.1 (detecting new vulnerabilities and configuration changes).
Why almost every SaaS company tests anyway:
- The auditor needs evidence. Without a pentest, you must show another way that you find exploitable weaknesses, fix them and confirm the fixes. A scan alone rarely shows exploitability.
- Buyers ask directly. Enterprise security questionnaires routinely ask for a third-party pentest from the last 12 months, separately from your SOC 2 report.
- Your own controls promise it. If your policy says “annual penetration test”, a Type 2 auditor will verify that you did one.
Is a pentest required for SOC 2 Type 1 vs Type 2?
| Type 1 | Type 2 | |
|---|---|---|
| What the auditor tests | Control design on one date | Control operation over a period (often 6–12 months) |
| Role of the pentest | Supports design: a testing policy exists and findings feed remediation | Shows the testing control ran as written during the period |
| Timing that counts | A recent test before the report date | A test inside the observation period, plus remediation and retest evidence |
Do I need annual penetration testing for SOC 2?
The criteria set no frequency. Annual testing is the common cadence because it matches the audit cycle and the “last 12 months” question buyers ask. Add a test after significant change: a new product, a major authentication redesign, a cloud migration or an acquisition. CC8.1 (change management) is where an auditor will connect that testing to your controls.
Whatever cadence you choose, write it into policy and keep to it. A Type 2 auditor checks the evidence against your stated cadence, not against an industry norm.
What should a SOC 2 penetration testing cover?
Scope the test outward from your SOC 2 system description. If a system stores, processes or protects customer data inside the boundary, it belongs in scope or needs a documented reason to be out.
| Component | Include when | Commonly missed |
|---|---|---|
| Web application (authenticated) | Customers log in to your product | Testing every role and tenant boundary, not just one user |
| APIs | Your app or customers call them | Broken object-level authorization (one user/tenant reading another’s data) |
| External network | Anything is internet-facing | Admin panels, VPN gateways, forgotten subdomains |
| Cloud configuration (AWS, Azure, GCP) | Production runs in the cloud | IAM over-permission, public storage, exposed management endpoints |
| Internal network | You run offices or internal infrastructure in scope | Lateral movement from a compromised laptop |
| Mobile app | You ship iOS or Android clients | Testing the API behind the app, not only the app binary |
| Social engineering | Your controls rely on staff behaviour for access | Usually optional for a first SOC 2; ask your auditor |
Ask your auditor what they expect in scope before you sign a statement of work. It is a short conversation and avoids a challenged scope weeks before fieldwork.
When should you schedule the SOC 2 penetration testing?
Schedule testing 60–90 days before your audit window opens. That leaves time to fix material findings, run the retest and package evidence. Thirty days is the practical minimum; under four weeks, plan the scope around what can be fixed in time.
For a Type 2, the test should also fall inside the observation period, so it evidences a control that operated during the period being reported.
An auditor will look for actions being taken to remediate findings from the current years test or the previous years depending on when it falls within the audit window.
What should a SOC 2 pentest report include?
Auditors look for evidence that a qualified, independent party tested the right systems and that management acted on what was found. A report that holds up includes:
- Executive summary for auditors and leadership: scope, dates, overall risk, material findings in plain language.
- Scope and rules of engagement: systems, environments, roles tested, and any exclusions with the reason.
- Methodology: a named standard such as NIST SP 800-115 or the OWASP Web Security Testing Guide, and which findings were manually validated.
- Findings with severity, evidence of exploitation, business impact and specific remediation.
- Trust Services Criteria mapping built into the findings, not bolted on as an appendix.
- Remediation status and retest results: a retest letter or updated report showing which findings are closed.
- Attestation letter: a short letter you can share with customers without handing over the full technical report.
How much does a SOC 2 pentest cost, including retest and executive summary?
Published starting prices put SOC 2 penetration testing for a SaaS product at $5,000–$20,000. A human-tested single web app with its APIs starts at $5,250–$10,800 at the firms that publish a price for that scope (SOC2Auditors.org, checked Oct 5, 2026). Whether the retest and executive summary are in that number varies by firm, so ask.
Those are starting prices from firms that publish them. Broader market guides run higher: Synack’s 2026 guide puts most engagements at $10,000–$30,000 (Synack), and ComplyJet puts a standard SaaS scope of web app, API and cloud at $8,000–$25,000 (ComplyJet).
SOC 2 penetration testing market ranges by scope
| Scope | Published market range (USD) | What pushes it to the high end |
|---|---|---|
| One asset, or autonomous test with no human tester | ~$1,000–$3,500 | Rarely accepted as pentest evidence on its own |
| One web app + APIs, human-tested | $3,000–$11,000 | Many roles, multi-tenancy, large API surface |
| Several apps, cloud, or complex authorization | ~$9,000–$20,000+ | Cross-application access paths, specialist cloud testing |
| External network | $4,000–$12,000 | IP count (50+ IPs scales up) |
| Internal network | $5,000–$35,000 | Lateral movement and privilege escalation depth and network size |
| Cloud | $10,000–$50,000 | Multiple tenants or providers, IAM depth |
Sources: SOC2Auditors.org (Oct 2026); Synack 2026 pricing guide
What drives the price
| Factor | Lowers cost | Raises cost | What the extra cost buys you |
|---|---|---|---|
| Applications and APIs in scope | One app, a few dozen endpoints | Several products, large API surface, mobile clients | Coverage of every system the auditor will ask about |
| User roles and tenancy | Two or three simple roles | Multi-tenant, admin and support roles, SSO | Proof one customer can’t reach another’s data, the question enterprise buyers ask most |
| Cloud footprint | One account, one region | Multiple accounts or providers | IAM and storage misconfigurations found before an attacker or auditor does |
| Network surface | Few public IPs | Large IP ranges, internal network in scope | Evidence for boundary and lateral-movement controls |
| Testing approach | Gray box with credentials and docs | Black box discovery, or white box with code review | Gray box puts paid hours into attacking, not rediscovering; white box adds code-level depth |
| Tester seniority | Junior testers, heavy automation | Senior testers, manual exploitation | Business-logic and chained findings that scanners miss |
| Reporting | Standard technical report | Executive summary, TSC mapping, attestation letter, auditor call | A report your auditor and customers accept the first time |
| Retesting | Retests billed per round | One or more retests included | Closure evidence without a surprise second invoice |
| Timeline | Booked 60–90 days ahead | Expedited start or rush report | Testing that lands before fieldwork, not during it |
The cheapest way to cut the cost of SOC 2 penetration testing is a tight, documented scope that matches your SOC 2 boundary. A test scoped to everything you own costs more and can still miss what the auditor asks about.
Why the lowest quote is rarely the cheapest SOC 2 pentest
The price that matters is the total cost of getting accepted evidence, not the first invoice. Low quotes usually save money by cutting one of three things, and each comes back as cost later:
- The human tester. An automated-only report can be treated as a vulnerability scan, which means buying a second test before fieldwork.
- The scope. Excluding APIs, roles or cloud leaves gaps an auditor or customer questions, and filling them late costs more than scoping them in.
- The retest. Billed per round, retests add up when remediation happens in phases, and without one you have no closure evidence.
Compare quotes on tester-days, scope coverage, retest terms and deliverables, then on price. Two quotes that differ sharply in effort for the same scope are not testing to the same depth.
How Canary Trap prices SOC 2 penetration testing
Canary Trap quotes each engagement to your SOC 2 scope after a short scoping call, and the quote states testing effort, retest terms and deliverables. We don’t aim to be the cheapest test on the market; we aim to be the one your auditor and your customers accept without a second engagement.
What a SOC 2 pentest quote should include
Compare quotes line by line. Two quotes for “a web app pentest” can differ by tester-days, retests and deliverables.
| Line item | Why it matters for SOC 2 | Standard at Canary Trap |
|---|---|---|
| Signed scope and rules of engagement | Proves what was authorized and tested | Yes |
| Manual testing, with automated findings validated | Separates a pentest from a scan | Yes, human-led |
| Executive summary | Gives auditors and leadership a readable risk view | Yes including executive reports |
| Trust Services Criteria mapping | Connects findings to the controls the auditor tests | Yes |
| Retest report | Closes the loop: shows fixes worked | Yes |
| Attestation letter for customers | Answers security questionnaires without sharing the full report | Yes |
| Findings debrief | Engineers understand and prioritize fixes | Yes |
Is a $3,000 pentest good enough for SOC 2?
Usually not on its own. Offers under about $3,500 typically cover a single asset or run autonomously without a human tester. An auditor may treat an automated-only report as a vulnerability scan, and an enterprise buyer may ask who tested authorization and tenant isolation.
If budget is tight, narrow the scope rather than remove the human tester. One production app, its APIs and its most privileged roles, tested manually, is stronger evidence than an automated sweep of everything.
Who should I hire for a SOC 2 pentest?
For SOC 2 penetration testing, hire an independent offensive security firm, not your SOC 2 auditor, that scopes to your system boundary, tests manually, includes a retest and writes a report mapped to the Trust Services Criteria. Use the criteria below on every proposal, including ours.
Criteria for choosing a SOC 2 penetration testing firm
| Criterion | Ask the firm | Good answer | Red flag |
|---|---|---|---|
| Independence | Are you also our auditor or readiness consultant? | No; testing and attestation are separate firms | The CPA firm auditing you also tests the same systems |
| Scope fit | How did you size this scope against our system description? | They asked for it and mapped each in-scope system | A template scope or a flat IP count for a SaaS app |
| Human-led testing | Who tests, and what share is manual? | Named, certified testers; automated output validated by hand | “Automated pentest” or no tester named |
| Methodology | Which standard do you follow? | NIST SP 800-115, OWASP WSTG or PTES, named in the SOW | No standard named |
| Sample report | Can we see a redacted SOC 2 report? | Executive summary, evidence of exploitation, TSC mapping | Only a scanner export or no sample offered |
| Retest | How many retests, within what window, at what cost? | At least one retest included, with a retest letter | Retests quoted separately or not mentioned |
| Customer-facing proof | What can we give a customer instead of the full report? | An attestation letter summarizing scope and dates | Only the full technical report |
| Timeline | When can you start, and when do we get the report? | Dates that land before your audit window | Vague dates in peak audit season |
| Auditor support | Will a tester answer our auditor’s questions? | Yes, with terms stated | Questions routed through sales only |
Why your auditor shouldn’t run the pentest
A pentest produces evidence about controls the auditor then evaluates. When the same CPA firm does both, AICPA independence rules treat it as a self-review threat that needs safeguards. Separate firms remove the question for your auditor and for any customer reading your report.
Best value pentesting for startups going through SOC 2 the first time
For a first SOC 2, value means the smallest scope that answers your auditor and your next enterprise buyer, tested by a human, with the retest included. Five steps:
- Freeze the system boundary first. Test once production and the SOC 2 system description are stable.
- Scope the product, not the company. Usually the production web app, its APIs and the cloud account behind them. Add internal network or social engineering only if your auditor or customers ask.
- Choose gray box testing. Give testers credentials for each role and API docs; they spend paid time attacking instead of rediscovering.
- Buy the retest and attestation letter up front. Fixing findings is only evidence once a retest confirms it, and the letter answers questionnaires.
- Book 60–90 days before your audit window so remediation does not compete with fieldwork.
What to skip on a first audit: a full red team, testing of systems outside the boundary, and an automated-only test sold as a pentest.
How Canary Trap runs SOC 2 penetration testing
Canary Trap is a North American offensive security firm. Our SOC 2 penetration testing engagements are human-led and scoped to your system description, with methodology statements and Trust Services Criteria mapping in the report. Every engagement includes 120-day retest terms and executive summary and Letter of Attestation.
- Testers: Minimum OSCP certifications, in-house staff
- Methodology: Aligns with PTES, OWASP and MITRE attack frameworks.
- Start and turnaround: Up to 2 weeks to start and up to 2 weeks to test for a single app and API.
- Pricing: quoted to your SOC 2 scope after a short scoping call, with testing effort, retest terms and deliverables stated in the quote.
- Between tests: External Continuous Assurance keeps internet-facing exposure visible between annual tests
Relevant services: Application, API, External and Internal Network Penetration Testing, and Cloud Configuration Review.
SOC 2 penetration testing FAQ
Is a vulnerability scan enough for SOC 2?
Rarely on its own. A scan finds known weaknesses automatically and supports CC7.1. A pentest adds human exploitation, attack chains and business-logic testing, which is the evidence CC4.1 and enterprise buyers look for. Most SOC 2 programs run both: recurring scans plus an annual pentest.
How often should we test our web app and API to stay SOC 2 compliant?
At least annually, plus after significant changes such as a new API, an authentication redesign or a cloud migration. SOC 2 sets no frequency, so the cadence in your own policy is the one your auditor tests against.
How much does a SOC 2 pentest for a SaaS app cost?
Published starting prices run $5,000–$20,000 for a SOC 2–scoped SaaS test, and $5,250–$10,800 for one human-tested web app with its APIs (SOC2Auditors, Oct 2026). Roles, tenancy, API surface, cloud scope and retest terms move a quote within that range. Canary Trap quotes each engagement to your scope after a short scoping call, with testing effort, retest terms and deliverables stated in the quote.
What do I lose with a cheap compliance pentest?
Usually the human tester, the retest or the scope. Low-cost offers often run automated tools only, exclude APIs or authenticated roles, or bill retests separately. The result can be a report the auditor treats as a scan and a customer questions.
How do I get a pentest report auditors won’t reject?
Match the scope to your system description, use a firm independent of your auditor, and make sure the report has a named methodology, evidence of exploitation, Trust Services Criteria mapping, remediation status and a retest letter. Share the planned scope with your auditor before testing starts.
Do all findings need to be fixed before the audit?
No, but every material finding needs a documented response: fixed and retested, mitigated by a compensating control, or formally risk-accepted with an owner and date. Unaddressed critical findings are what draw exceptions.
We need a pentest fast for an upcoming SOC 2 audit. How soon can testing start?
Canary Trap can typically start within 2 weeks after the statement of work is signed. With fewer than four weeks to your audit window, scope to what can be fixed and retested in time, and agree that plan with your auditor.
Can one pentest cover SOC 2 and ISO 27001?
Yes, if the statement of work scopes for both. ISO 27001 also does not mandate a pentest by name, but testing supports Annex A 8.8 (management of technical vulnerabilities). Ask for findings mapped to both frameworks in one report.
Can our internal team handle SOC 2 penetration testing?
The criteria allow it, but auditors and buyers give more weight to an independent third party. An internal team testing systems it built or runs has a harder time showing independence.
Preparing for a SOC 2 audit? Book a scoping call to confirm scope, timeline and report format before your audit window opens.
