A SOC 2 audit can demonstrate that your organization has security controls in place. But if those controls have never been tested against a real attacker, how much confidence do they actually provide?
That is where penetration testing comes in.
SOC 2 does not explicitly require a penetration test. The AICPA Trust Services Criteria do not contain a standalone requirement stating that every organization must perform one. However, penetration testing can provide important evidence that security controls are operating effectively, particularly around risk identification, monitoring, vulnerability management, and security response. The Cloud Security Alliance also notes that customer contracts and future business requirements can make penetration testing effectively necessary even when the SOC 2 criteria do not mandate it.
For organizations preparing for SOC 2, the question therefore shouldn’t simply be:
“Do we need a penetration test?”
It should be:
“Is our penetration test rigorous enough to demonstrate the security posture we claim in our SOC 2 program?”
Choosing the right provider can make the difference between receiving a compliance-focused report and uncovering vulnerabilities that genuinely matter.
How Do You Choose a Penetration Testing Provider for SOC 2?
Look for a provider that can:
- Understand your SOC 2 scope and Trust Services Criteria
- Test the systems that actually matter to your audit
- Combine automated discovery with manual exploitation
- Use experienced penetration testers
- Test applications, APIs, cloud infrastructure, networks, or other relevant attack surfaces
- Produce audit-ready documentation
- Clearly prioritize vulnerabilities by business risk
- Provide actionable remediation guidance
- Offer remediation validation and retesting
- Protect sensitive testing data
- Coordinate testing around your SOC 2 audit timeline
Most importantly, do not choose a penetration testing company solely because it provides a report that says “SOC 2 compliant.”
Penetration testing is a security exercise first, and a compliance evidence exercise second.
Does SOC 2 Require Penetration Testing?
No. SOC 2 does not explicitly mandate penetration testing.
The AICPA’s Trust Services Criteria address controls related to Security, Availability, Processing Integrity, Confidentiality, and Privacy, depending on the scope of the engagement.
A penetration test can provide evidence supporting several areas of a security program, including risk assessment, vulnerability identification, monitoring, and evaluation of whether controls are functioning effectively. The Cloud Security Alliance specifically identifies penetration testing as one potential source of evidence supporting SOC 2 control objectives.
There is another reason organizations should take penetration testing seriously:
Your customers may expect it.
Enterprise security questionnaires, procurement requirements, cyber insurance conditions, and customer contracts can request recent penetration testing regardless of whether the AICPA framework explicitly requires it.
So while penetration testing isn’t a universal SOC 2 requirement, it can become an important part of demonstrating a credible security program.
7 Things to Look for When Choosing SOC 2 Penetration Testing Services
1. Choose a Provider That Understands SOC 2
A penetration test performed without understanding your SOC 2 scope can produce a technically impressive report that is difficult to use as audit evidence. Your provider should understand:
- Your SOC 2 audit scope
- In-scope applications and infrastructure
- Relevant Trust Services Criteria
- Your control environment
- Evidence requirements
- Your audit timeline
Ask the provider:
“How will you align the penetration test with our SOC 2 scope?”
A good provider should be able to answer without treating SOC 2 as a checkbox.
2. Make Sure the Right Attack Surface Is Being Tested
A penetration test is only as valuable as its scope. Depending on your environment, testing may need to cover:
- Web applications
- APIs
- Mobile applications
- External infrastructure
- Internal networks
- Cloud infrastructure
- Authentication mechanisms
- Authorization controls
- Containers
- Network segmentation
- Third-party integrations
A SaaS company, for example, may need a very different testing strategy from a traditional enterprise. The goal isn’t to test everything. It’s to test what creates meaningful risk within your SOC 2 environment.
CREST’s penetration testing guidance similarly emphasizes testing the right systems, with the right people, for the right reasons, at the right time.
3. Look for Manual Testing, Not Just Automated Scanning
This is one of the most important questions to ask.
A vulnerability scan is not the same thing as a penetration test.
Automated tools are valuable for discovering known vulnerabilities and configuration issues. But experienced penetration testers can investigate attack paths, chain weaknesses, bypass controls, manipulate business logic, and identify vulnerabilities automated tools may miss.
Google’s penetration testing provider guidance recommends looking for firms that specialize in security services and have demonstrated technical expertise and security research capabilities.
Ask:
“How much of your testing is performed manually by experienced testers?”
If the answer is primarily about scanners, dashboards, and automated findings, dig deeper.
4. Ask Who Will Actually Perform the Test
The company logo on the proposal doesn’t perform the penetration test. People do. Before signing, ask:
- Who are the assigned testers?
- What is their offensive security experience?
- What certifications do they hold?
- Have they tested environments similar to yours?
- Who reviews the findings?
- Who will communicate critical vulnerabilities?
Experience matters because sophisticated testing requires judgment. A qualified tester should be able to distinguish between:
A vulnerability that technically exists
and
A vulnerability that creates a realistic attack path into your environment.
5. Demand a Report That Your Security Team Can Actually Use
A penetration testing report shouldn’t simply contain a list of CVEs and severity scores. A strong report should clearly explain:
What was found?
The vulnerability and affected asset.
Why does it matter?
The business and security impact.
How can it be exploited?
The attack path and supporting evidence.
How severe is it?
A risk-based severity assessment.
How should it be fixed?
Specific remediation guidance.
Was it fixed?
Retesting and validation results.
This becomes particularly important when penetration testing is being used as supporting evidence for SOC 2.
Your auditor needs evidence. Your security team needs intelligence. Your report should provide both.
6. Make Remediation and Retesting Part of the Conversation
Finding vulnerabilities is only half the job. What happens next matters more. Before selecting a provider, ask:
“Do you provide remediation guidance and retesting?”
A strong engagement should follow a cycle such as:
Discover → Validate → Prioritize → Remediate → Retest → Document
Retesting can demonstrate that critical findings have actually been addressed rather than simply acknowledged. This is especially valuable when your penetration test needs to support an upcoming SOC 2 examination.
Don’t wait until the audit starts to discover that your critical findings haven’t been closed.
7. Make Sure the Provider Can Protect Your Data
Penetration testing often involves sensitive information. The provider may receive:
- Application credentials
- Architecture information
- API documentation
- Source code
- Vulnerability data
- Customer information
- Cloud configuration details
- Internal network information
Ask how the provider handles:
- Data transmission
- Storage
- Encryption
- Access control
- Retention
- Secure deletion
- Testing credentials
- Report distribution
Accorian’s own penetration testing services recommend evaluating a provider’s data protection practices, including how testing information is transmitted, stored, retained, and disposed of.
What Should a SOC 2 Penetration Test Cover?
There is no universal SOC 2 penetration testing scope. Your scope should reflect your environment and risk. For a SaaS organization, this could include:
- External attack surface: Public-facing infrastructure, domains, exposed services and cloud assets.
- Web applications: Authentication, authorization, session management, business logic, input validation and application vulnerabilities.
- APIs: Authentication, authorization, rate limiting, object-level access controls and API-specific attack paths.
- Cloud infrastructure: Configuration weaknesses, exposed services, identity and access controls, segmentation and attack paths.
- Internal infrastructure: Depending on the SOC 2 scope, internal systems, network segmentation, privilege escalation and lateral movement.
- Mobile applications: Where mobile apps are part of the service being assessed.
The scope should ultimately be tied to the systems and services included in your SOC 2 examination.
When Should You Conduct a Penetration Test for SOC 2?
Do not schedule your penetration test at the last possible moment. Give yourself enough time to:
- Define the scope
- Conduct testing
- Review findings
- Remediate vulnerabilities
- Retest
- Document remediation
- Provide evidence to your auditor
A penetration test that finishes days before your audit may identify a serious vulnerability when there is no realistic time left to remediate it. A better approach is to treat penetration testing as part of your SOC 2 readiness timeline, not an item to complete at the end.
Penetration Testing vs. Vulnerability Scanning for SOC 2
These are not interchangeable. Vulnerability scanning primarily uses automated tools to identify known vulnerabilities and weaknesses.
Penetration testing involves security professionals actively attempting to exploit vulnerabilities and demonstrate realistic attack paths.
Both can have value.
But a vulnerability scan alone should not be represented as a substitute for a comprehensive penetration test. The distinction matters when customers, auditors, or security teams are evaluating the strength of your testing program.
What Makes a Penetration Test “SOC 2 Ready”?
A strong SOC 2-oriented penetration testing engagement should provide:
- Relevant scope: Testing covers the systems and applications that matter to your SOC 2 environment.
- Independent testing: The assessment provides an objective evaluation of your security posture.
- Technical depth: Testing goes beyond automated scanning.
- Clear evidence: Findings, exploitation evidence, methodology, scope, and testing dates are documented.
- Risk prioritization: Findings are categorized according to their actual impact.
- Remediation guidance: Your team understands how to address the weaknesses.
- Retesting: Remediated vulnerabilities can be validated.
- Audit usability: The resulting documentation can support your broader SOC 2 evidence package.
Don’t Choose the Cheapest Penetration Testing Option!
The lowest-cost penetration test can become the most expensive one if it:
- Misses critical vulnerabilities
- Tests the wrong systems
- Provides weak evidence
- Requires another test before the audit
- Produces findings your team cannot act on
- Creates delays in your SOC 2 timeline
The better question is:
“Will this engagement give us meaningful security intelligence and credible evidence for our SOC 2 program?”
That is the value you should compare.
Why Choose Accorian for SOC 2 Penetration Testing?
Accorian approaches penetration testing as a security assessment, not a compliance checkbox. Its penetration testing capabilities span web and mobile applications, APIs, networks, cloud environments, and broader attack surfaces, helping organizations identify vulnerabilities and validate their security controls against realistic attack scenarios.
Accorian also combines penetration testing with broader cybersecurity and compliance expertise. That matters for SOC 2 because organizations often need to connect:
Penetration Testing → Risk → Remediation → Controls → Evidence → Audit
Rather than treating those as disconnected activities. Accorian currently highlights 450+ clients and 96% client retention, alongside its broader compliance and cybersecurity capabilities.
It also operates a unified model combining audit and testing services, allowing organizations to address compliance and offensive security requirements through one broader cybersecurity partner.
And through GORICO, Accorian’s AI-enabled GRC platform, organizations can centralize compliance workflows, evidence, control mapping and remediation across 200+ frameworks, with the platform highlighting 65% evidence reusability.
The advantage is straightforward:
- Find the vulnerability.
- Understand the risk.
- Fix the weakness.
- Validate the remediation.
- Build stronger evidence.
That’s a much more useful outcome than simply receiving a penetration testing report.
SOC 2 Penetration Testing Checklist
Before hiring a provider, ask:
- Do they understand SOC 2 and the Trust Services Criteria?
- Can they scope testing around our actual SOC 2 environment?
- Will experienced testers perform manual testing?
- Can they test our applications, APIs, cloud, network, or other relevant attack surfaces?
- Will we receive detailed exploitation evidence?
- Are findings prioritized by real-world risk?
- Is remediation guidance included?
- Is retesting available?
- Can they protect sensitive testing data?
- Can the engagement fit our SOC 2 audit timeline?
- Can they help connect security findings to our broader compliance program?
If the answer to several of these is unclear, don’t select the provider yet.
Don’t buy a penetration test because your SOC 2 checklist says you need one.
Buy one because you need to know whether the security controls you’re asking customers to trust can withstand real-world attack techniques. The right provider should understand your SOC 2 environment, test the attack surface that matters, uncover meaningful vulnerabilities, provide actionable remediation guidance, validate fixes, and produce evidence your security and compliance teams can actually use.
SOC 2 proves that you have controls. Penetration testing helps prove that those controls are being challenged.
If your SOC 2 audit is approaching, the best time to discover a critical vulnerability is before your auditor or customer does.
Ready to test your SOC 2 security posture?
Explore Accorian’s Penetration Testing Services and connect with its offensive security experts to build a penetration testing approach around your SOC 2 scope, technology environment, and risk profile.
