Penetration testing for SOC 2.
SOC 2 is about proving your security controls work, and an independent penetration test is one of the clearest ways to do it. We run the test to CREST standards and give you evidence your auditor can point to. We do not issue the SOC 2 report: your auditor does that, and keeping us independent of them is exactly the point.
What SOC 2 asks for.
Independent testing is a big part of how you satisfy it. On the testing side, this is what the process expects.
- Evidence that your security controls operate effectively
- Independent testing your auditor can rely on
- A track record of finding and fixing issues
- Clear remediation you can show was actioned
Who does what.
A penetration test is one piece of the picture. Here is the clean line between the testing we do and the certification a separate, independent party provides.
We do the testing
- The independent penetration test, by CREST-certified testers
- A report your auditor can map to the relevant criteria
- Prioritised fixes and a free retest of critical and high findings
They do the rest
- The examination against the Trust Services Criteria
- The SOC 2 report itself
SOC 2, answered.
Straight answers to what clients ask most.
Does SOC 2 require a penetration test?
SOC 2 does not mandate one by name, but auditors very commonly expect independent penetration testing as evidence that your controls work. It is one of the strongest pieces of evidence you can bring.
Do you produce our SOC 2 report?
No. We are the penetration testers. Your SOC 2 report is produced by a separate auditor, usually a CPA firm; we give them the independent test and evidence to rely on.
Does it help with a Type I or a Type II?
Both benefit from an independent penetration test. For a Type II especially, showing that you test regularly and fix what you find is exactly the kind of evidence auditors look for.
Need a pen test for SOC 2?
Tell us where you are in the process and who is asking. We will come back within one working day with a suggested approach and a fixed-price scope, with no sales theatre.