Whether SOC 2 requires a penetration test, what the AICPA criteria actually say, what a test costs in 2026, and how to time it inside a Type 2 observation period.
SOC 2 does not explicitly require a penetration test. The AICPA Trust Services Criteria mention penetration testing once, as an example under criterion CC4.1, and points of focus are guidance rather than mandatory controls. In practice, many SOC 2 auditors treat an annual third-party penetration test as the expected evidence for an internet-facing SaaS product, so most SaaS teams commission one. As of November 2026, published prices for a SOC 2 penetration test start at about US$5,000 for one web application, and the test is paid separately from the SOC 2 audit fee.
The SOC 2 Trust Services Criteria are published by the AICPA as TSP section 100, the 2017 Trust Services Criteria with revised points of focus (2022). Penetration testing appears in the points of focus for CC4.1, which covers ongoing and separate evaluations of controls. That point of focus lists penetration testing as one example of a separate evaluation, alongside independent certifications such as ISO 27001 and internal audit assessments.
CC7.1 is the other SOC 2 criterion that matters. CC7.1 asks an organisation to detect configuration changes and newly discovered vulnerabilities, and its points of focus include running vulnerability scans periodically and after significant changes.
The AICPA is clear that points of focus are not requirements, and a SOC 2 auditor does not test whether each one is addressed. So the honest answer is "not required, but usually expected". The SOC 2 auditor decides whether the evidence for CC4.1 and CC7.1 is sufficient, and for a SaaS application on the internet, a recent penetration test report is the evidence auditors most commonly see and accept.
A SOC 2 report and a penetration test answer different questions. A SOC 2 report is an attestation by a licensed CPA firm that your controls are suitably designed (Type 1) or designed and operating effectively over a period (Type 2). A penetration test is a technical exercise in which security testers try to break into your application and infrastructure, then report what they reached.
The SOC 2 auditor does not perform the penetration test. The SOC 2 auditor reads the penetration test report as evidence, along with how the findings were handled. A SOC 2 audit and a penetration test are separate engagements with separate fees.
A vulnerability scan is automated: a tool checks systems against known weaknesses and misconfigurations and produces a list. A penetration test is mostly manual: a person chains weaknesses together and shows what an attacker could actually reach. DAST (dynamic application security testing) is automated scanning of a running web application, so a DAST tool is a scanner, not a penetration test.
For SOC 2, scans and penetration tests map to different criteria. Regular vulnerability scans are the natural evidence for CC7.1. A penetration test is the natural evidence for the separate evaluation in CC4.1. Many small SOC 2 teams run a scan monthly and a penetration test once a year. Free open-source scanners such as OWASP ZAP exist, so the main cost of scanning is your team's time to triage results.
A SOC 2 penetration test is paid to a security testing firm, separately from the SOC 2 audit. Testing firms price by scope: applications, API groups, user roles and cloud accounts. These are the publicly stated SOC 2 penetration test prices found in November 2026.
| Source and scope | Published price (USD) |
|---|---|
| Blaze Information Security, Lite: one web application or API group, up to two roles, retest as an add-on | US$4,999 |
| Blaze Information Security, Essentials: one application, up to three roles, business logic testing, one retest round | US$7,499 |
| Blaze Information Security, Assurance: one application, up to five roles, advanced testing, one retest round | US$8,999 |
| Blaze Information Security, planning range for broader engagements | US$5,000 to US$25,000 |
| Fractional CISO, a basic test that gets a company "compliant" | Around US$5,000 |
| Fractional CISO, a quality test with actionable results | US$15,000 to US$30,000 |
The penetration test is one line in a SOC 2 budget. This table shows the other lines a small SaaS team pays in the same year. The full picture is in the SOC 2 cost breakdown for startups.
| SOC 2 cost component | Typical range (USD, November 2026) | Who charges it |
|---|---|---|
| Penetration test, one web application and API | US$5,000 to US$15,000 | Security testing firm |
| Vulnerability scanning | US$0 with open-source tools, plus team time | Your team |
| SOC 2 Type 2 audit | US$10,000 to US$30,000+ | Licensed CPA firm |
| Compliance platform | US$225 per month with CertAssist; Vanta and Drata do not publish list pricing | Software vendor |
| Fixing what the test finds | Engineering time | Internal |
The scope of a SOC 2 penetration test should match the scope of the SOC 2 report. If the SOC 2 system description covers your production web application, its API and the cloud account it runs in, the penetration test should cover those. For a 5 to 50 person SaaS company, the usual minimum SOC 2 penetration test scope is:
Ask the testing firm for the full technical report and a short attestation letter you can give to the SOC 2 auditor and share with customers. Use testers independent of the people who built the system. If you have never scoped a test, NIST SP 800-115, the NIST technical guide to security testing, is a neutral reference for what a test plan should contain.
For SOC 2 Type 2, schedule the penetration test early enough in the observation period to fix the findings and retest before the period ends. A test in the first third of a 6 or 12 month window puts the report, the remediation tickets and the retest result all inside the period. A test shortly before the window starts is often accepted if it is under 12 months old and the system has not changed significantly. Confirm with your SOC 2 auditor before booking. How long the window should be is covered in SOC 2 observation period: 3, 6 or 12 months.
Open penetration test findings do not automatically fail a SOC 2 audit, because a SOC 2 report has no pass or fail grade. The SOC 2 auditor looks at how findings were handled: critical and high findings fixed or formally risk-accepted with a written reason, and a retest or ticket trail showing each fix. A critical finding left open with no owner and no plan is the kind of gap that can become an exception in the SOC 2 report. More on this in what auditors really look for in your evidence.
A small team can sometimes skip a dedicated SOC 2 penetration test, but that is a judgement for the auditor and your customers, not a rule. Skipping is more defensible when:
Skipping is hard to defend for a multi-tenant SaaS product holding customer data, or when customers' security questionnaires ask for a penetration test summary.
CertAssist does not run penetration tests or vulnerability scans, and CertAssist is not a substitute for a security testing firm or for the CPA firm that issues the SOC 2 report. CertAssist is where the SOC 2 work is organised: CC4.1, CC7.1 and every other criterion sit on one board with evidence checklists, the penetration test report and remediation evidence attach to the controls they support, and the auditor reviews it with read-only access. CertAssist has no integrations, so CertAssist never needs access to the systems your testers are attacking. The trade-off: platforms with integrations pull scanner results in automatically; with CertAssist you upload them. As of November 2026, CertAssist costs US$225 per month, or US$2,475 per year, at the launch price.
Does SOC 2 require penetration testing?
SOC 2 does not explicitly require penetration testing. The AICPA Trust Services Criteria list penetration testing once, as an example of a separate evaluation under CC4.1, and points of focus are guidance rather than requirements. Many SOC 2 auditors still expect a recent third-party penetration test for an internet-facing SaaS product, and enterprise customers often ask for one, so most SaaS teams commission a test at least once a year.
Does SOC 2 Type 2 require penetration testing?
SOC 2 Type 2 uses the same criteria as SOC 2 Type 1, so penetration testing is not explicitly required for Type 2 either. The difference is timing. A SOC 2 Type 2 report covers an observation period of 3 to 12 months, so a penetration test performed inside that window, with findings fixed and retested before it ends, gives the SOC 2 auditor the strongest evidence for CC4.1.
Does SOC 2 include penetration testing?
A SOC 2 audit does not include a penetration test. The CPA firm that issues the SOC 2 report examines your controls and evidence and does not attack your systems. The penetration test is a separate engagement with a security testing firm, paid separately, with published prices starting at about US$5,000 for one web application as of November 2026. The SOC 2 auditor then reviews the penetration test report as evidence.
Why do we need penetration testing?
Penetration testing shows what an attacker could actually reach, rather than a list of theoretical weaknesses. A penetration tester chains vulnerabilities together, tests business logic and checks whether one customer can read another customer's data, which automated scanners usually miss. For a SOC 2 programme, a penetration test is also widely accepted evidence that controls are evaluated independently, and it answers the penetration test question in enterprise security questionnaires.
How long does SOC 2 certification last?
SOC 2 is an attestation report, not a certification, so a SOC 2 report has no formal expiry date. In practice, customers treat a SOC 2 report as current for about 12 months after the end of its period, which is why most companies renew SOC 2 every year. Penetration tests usually follow the same annual cycle, so each new SOC 2 Type 2 period contains a fresh test.
CertAssist lays out every SOC 2 criterion on one board, gives you editable policy and evidence templates, and lets your auditor review it all in one place, for US$225 a month. No integrations, no access to your systems.
See pricing FrameworksFlat $225 a month, or $2,475 a year (12 months for the price of 11). All prices in USD.
