Is a vulnerability scan enough for SOC 2?

Scans help, but most auditors and enterprise customers expect a penetration test as well.

Do we need to fix everything before the audit?

Auditors mainly want to see that findings are risk-assessed and tracked to resolution. Fixing high-risk issues first is sensible.

SOC 2

Penetration testing for SOC 2

SOC 2 doesn’t name penetration testing as a mandatory control, but in practice most auditors and customers expect to see one. Here’s what that means.

Request my free AI pentest

£0 · no payment details · no obligation

Is a pentest required for SOC 2?

The AICPA Trust Services Criteria require you to identify and evaluate vulnerabilities and monitor your controls (notably CC4.1 and CC7.1). Penetration testing is the most common way companies evidence this, and the criteria’s guidance refers to it. Most auditors will ask for a recent test.

What a SOC 2 pentest usually covers

Your customer-facing application and APIs
Authentication, authorisation and tenant isolation
Cloud configuration relevant to the system in scope
Evidence that findings were tracked and fixed

How often

Annually is the common expectation, plus after significant changes to the system in scope.

A note on scope

Our complimentary AI pentest is a focused first look, not a formal compliance assessment. If your auditor, assessor or customer needs a full report against a defined scope, we can quote for a full penetration test.

All testing services →

Common questions

Ready to get started?