SOC 2 · compliance

SOC 2 never says “pentest.” Your auditor still asks for one.

No SOC 2 criterion names a penetration test by that word, but auditors routinely expect one as supporting evidence that your access, change-management and vulnerability-management controls actually work. This page covers what a SOC 2 penetration test has to do, what it costs, and the report format an auditor can read — with every finding reproduced from a clean session before it is written down.

SOC 2 · compliance · 27 October 2026By Enes Çetinkaya

The short version: SOC 2 does not mandate a penetration test in so many words, yet most auditors expect a recent, independent one as evidence for the logical-access and threat-monitoring criteria. A SOC 2-ready pentest is scoped to your in-scope system, reproduces every finding, retests the fixes, and hands you a report whose findings already map to the Trust Services Criteria — so the evidence falls out of the test instead of becoming a second project.

Is a penetration test required for SOC 2?

Not by name. The AICPA Trust Services Criteria describe what must be true — that access is controlled, that threats are monitored, that vulnerabilities are managed — not which test proves it. In practice, auditors widely treat a recent third-party penetration test as the natural supporting evidence for several of those criteria, because a test that actually attempts exploitation is the clearest demonstration that a control holds. So while you will not fail an audit for the absence of a document titled “pentest,” you will almost always be asked for the evidence a pentest produces.

The practical reading: treat a penetration test as expected, scope it to the system in your SOC 2 boundary, and make sure its output speaks the auditor’s language.

Which controls a pentest speaks to

A single penetration-test finding is a fact about one security property being broken, and that fact usually maps to more than one criterion at once. The ones a pentest most directly supports:

  • CC6.1 — logical access security. A broken-object-level-authorization or cross-tenant finding is direct evidence about whether access is actually restricted.
  • CC7.1 / CC7.2 — threat and vulnerability monitoring. A test that finds and reproduces real issues demonstrates the monitoring and detection criteria are exercised, not assumed.
  • CC4.1 — control monitoring. Evidence that controls are evaluated by an independent party over time.
  • CC8.1 — change management. Testing that re-runs after a change shows new releases are assessed, not just the version audited last year.

A finding that already carries the control it breaks is the artefact the auditor was going to ask for anyway. We produce that mapping as part of the test — see how findings map to SOC 2, ISO 27001 and PCI.

1 reproduced finding cross-tenant invoice access CC6.1 logical access security CC7.1 threat & vuln monitoring CC8.1 change management maps to
One reproduced finding is evidence for several Trust Services Criteria at once — the mapping an auditor expects, written as part of the test rather than reconstructed in a spreadsheet later.

What to test for SOC 2

Scope the test to the system inside your SOC 2 boundary — the application, its API and the identities that act in it. For a SaaS or cloud-native product, grey-box testing (the tester is given credentials and context) is the usual fit: it skips the slow discovery phase and spends the budget on the control assessment itself. The surfaces that carry the most SOC 2 weight:

  • Access control — authenticated testing, cross-tenant/BOLA, privilege boundaries (the heart of CC6.1).
  • Business logic — sequences of individually-valid requests that break an invariant; no scanner signature catches these.
  • Injection and API security — the classic technical classes, mapped to OWASP and the relevant criteria.
  • AI features — if your product has an agent or assistant, its tools, data and permissions are in scope too.

What a SOC 2 penetration test costs

Published 2026 guidance puts a SOC 2-scoped penetration test broadly in the $5,000–$25,000 range, with a single-scope web-application or API test for a compliance framework often landing near $10,000 and larger multi-platform scopes higher (soc2auditors.org, 2026). Much of the spread is procurement, not testing: named testers, a retest, an attestation the auditor can read, and multi-application scoping all move the number.

SuperPentest publishes its prices rather than gating them behind “contact sales.” A one-off Deep test — a full assessment with the fix retest included, which meets a yearly pentest requirement — is €3,500; continuous coverage runs from €990/month. The exact scope is quoted in writing first, and under no finding, no fee an engagement that surfaces nothing is not billed. Full detail on the pricing section and in the machine-readable pricing.txt.

The report an auditor can actually read

A SOC 2 pentest is only useful if its output drops into the audit. That means each finding carries the control it breaks, the reproduction (request, response, the exact steps), the fix, and the retest result that closes it. A screenshot and a severity label are not evidence; a reproduced finding mapped to CC6.1 with a retest that shows it fixed is. We also report coverage honestly — what was tested, what had no eligible surface, what was blocked — so a clean result is a statement about what was exercised, not a certificate the application is secure. How every finding is verified →

How SuperPentest fits a SOC 2 program

SuperPentest is an autonomous penetration test that reproduces every candidate from a clean session before calling it a finding, maps each one to the framework control it breaks, and retests fixes. For an annual requirement, the one-off Deep test produces the mapped, retested report an auditor expects. For a program that ships continuously, continuous testing re-runs the same investigation on every change so the evidence never goes stale between audits. A shareable trust page keeps your current posture visible to customers and auditors without emailing a PDF around.

FAQ

Does SOC 2 require a penetration test?

Not by that word. No Trust Services Criterion names a pentest, but auditors widely expect a recent independent one as supporting evidence for the logical-access (CC6.1) and threat/vulnerability monitoring (CC7.x) criteria. Confirm the specific expectation with your auditor — but plan on providing the evidence a pentest produces.

How much does a SOC 2 penetration test cost?

Published 2026 guidance spans roughly $5,000–$25,000, with a single-scope compliance test often near $10,000. SuperPentest’s one-off Deep test is €3,500 with the retest included, and continuous coverage starts at €990/month; scope is quoted in writing, and no finding, no fee applies.

Does an automated pentest satisfy a SOC 2 auditor?

What an auditor needs is reproduced findings, mapped to the criteria, with fixes retested — not a particular testing method. A rigorous automated pentest that reproduces each finding from a clean session and retests the fix produces exactly that evidence. Requirements vary by auditor, so confirm with yours.

Which SOC 2 controls does a pentest map to?

Most directly CC6.1 (logical access) and CC7.1/CC7.2 (threat and vulnerability monitoring), and often CC4.1 (control monitoring) and CC8.1 (change management). A single finding typically speaks to several at once.

Have a SOC 2 audit coming up? Book a demo, see a worked finding, or read how findings map to compliance controls.