Security & privacy · SOC 2 Penetration Testing
SOC 2 penetration testing your auditor and customers can rely on
We test the web apps, APIs and cloud in your SOC 2 scope, then hand you a report built as audit evidence and a retest letter that shows what you fixed.
Is a penetration test required for SOC 2?
SOC 2 does not name penetration testing as a mandatory control. In practice, auditors and enterprise customers widely expect an annual third-party pentest, because the AICPA Trust Services Criteria list penetration testing as an example of the separate evaluations used to show controls work (CC4.1). A pentest also supports vulnerability management (CC7.1) and change testing (CC8.1).
Last reviewed by the Mighty Infosec team. This page is guidance, not legal advice.
Trust Services Criteria
Where a pentest fits in SOC 2
CC4.1
Monitoring activities. The points of focus name penetration testing as one of the separate evaluations an organization can use to confirm its controls are present and working.
CC7.1
Detection of new vulnerabilities and misconfigurations. Testing and scanning show you find weaknesses before attackers do.
CC8.1
Change management. A focused retest after major releases shows significant changes are tested before they reach customers.
CC3.2
Risk assessment. Threat modeling and pentest findings feed directly into the risks you document and treat.
How we help
AI-native testing, verified by experts
Scope to your system description
We align the test to the systems, data and boundaries in your SOC 2 scope, so the report matches what your auditor reviews.
AI-native coverage, human-verified
Agentic AI and automation cover every endpoint and role. Our researchers chase business logic, authorization and multi-tenant isolation flaws, and verify every finding.
Fix fast with clear guidance
Each finding comes with reproduction steps, impact and a concrete fix your developers can ship.
Retest and evidence
We retest your fixes and issue a letter summarizing remediation status, ready for your auditor and customer trust portal.
What you receive
- Executive summary for leadership and customers
- Technical report with scope, methodology, dates and severity ratings
- Retest results and remediation letter
- Findings mapped to OWASP and CWE
FAQ
SOC 2 Penetration Testing questions
How often should we pentest for SOC 2?
Most companies test once a year and after significant changes such as a new product, major architecture change or new cloud environment. Your auditor and your customers' security teams set the practical bar.
Do we need a pentest for SOC 2 Type I or Type II?
Both benefit. For Type II, a test completed during the observation period gives your auditor the clearest evidence that monitoring controls operated over time.
Will our auditor accept your report?
Our reports include the scope, methodology, testing dates, tester details, findings with severity and remediation status, which are the elements auditors typically look for. Final acceptance is always your auditor's decision, so share our sample report with them early.
Can you also help with customer security questionnaires?
Yes. Our executive summary and retest letter are written to be shared with customers, and we can join calls with enterprise security teams to walk through results.
Services
Services behind this engagement
Web Application Pentesting
AI-native, expert-verified testing of your web apps, from auth bypass to business-logic abuse.
API Pentesting
REST, GraphQL and gRPC testing focused on authorisation and data exposure.
Cloud Security & Pentesting
AWS, Azure and GCP configuration review and attack-path analysis.
Talk to us about SOC 2 Penetration Testing
Tell us what you're building. In a free 30-minute scoping call we'll map your risks and recommend the right engagement, whether you need a pentest, a threat model or an AI security review.