SOC 2 penetration testing companies

SOC 2 penetration testing companies are easy to find and hard to compare. Many pages say "SOC 2 ready" and stop there. The table lists providers whose own pages mention SOC 2, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026. A mention of SOC 2 on a provider page is not a promise that your auditor accepts the report.

What does the SOC 2 framework ask for?#

SOC 2 does not require a penetration test. It is an attestation against the AICPA Trust Services Criteria, which set objectives and leave the choice of controls to the company. Penetration testing appears once in the 2017 criteria (March 2020 update), as an example under CC4.1: "Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments."

The criteria also say that "Use of the trust services criteria does not require an assessment of whether each point of focus is addressed." AICPA revised the points of focus in 2022, and the file needs a free account, so we quote the 2017 text. The full requirement text and what it means for scoping are on SOC 2 penetration testing at penetrationtestservices.com. Our own comparison of how providers describe this is in the guide SOC 2 penetration testing providers.

Who needs a SOC 2 pentest, and when?#

You are likely to need one when an auditor or an enterprise customer asks for a recent third-party report. Linford & Co, a CPA firm, writes that a pentest "is not required" because the specific controls are not provided by the criteria, yet many teams buy one as evidence. The usual triggers are a first audit, a customer questionnaire and a major release inside the audit period.

For a Type II audit, Top Floor Security advises running the test early in the period so the fix and the retest fall inside it. Treat that as a vendor view and confirm dates with your auditor.

What should you ask SOC 2 pentest providers?#

Ask for these six items in writing before you sign.

Our guide judge a pentest provider by its sample report shows what to look for.

What drives the price?#

Price follows the number of applications, APIs and roles in scope, the depth of testing and the retest terms. Many providers quote after scoping. The "Published price" column shows a figure only where a provider lists one, so a blank price is a missing fact. See penetration testing cost for the ranges we sourced.

How do you read the table?#

A provider appears when its own pages mention SOC 2. The mention can refer to the provider's own audit or to support for your audit, so click a provider name to see the source and the date we checked it. The Sample report column says whether a report is public, on request or not published. Providers sort A to Z, and no provider pays for a position. Read how we compare for the rules. For other frameworks, see PCI DSS and ISO 27001.

What does an auditor check in the pentest report?#

Auditors read the report as evidence, and each wants something slightly different. A report that holds the items below saves a round of questions.

• The scope: systems, environments and the test window, with dates.
• The method and the standard used for severity.
• Findings with evidence, not a scanner export.
• The status of each finding after the retest.
• The name of the testing company and a statement of independence.

No provider can promise that an auditor accepts its report. Ask your auditor which of these items it needs.