# SOC 2 penetration testing companies

Source: https://pentestcompare.com/compliance/soc-2/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

SOC 2 penetration testing companies that name SOC 2 on their own pages, A to Z, with sources and dates, plus what auditors check in a pentest report.

> **Short answer:** SOC 2 does not require a penetration test, but many auditors and customers ask for a recent third-party report. This page lists pentest companies whose own pages mention SOC 2, A to Z, with price, retest and sample report columns and check dates. Send your auditor the provider's sample report and scope statement before you buy.

SOC 2 penetration testing companies are easy to find and hard to compare. Many pages say "SOC 2 ready" and stop there. The table lists providers whose own pages mention SOC 2, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026. A mention of SOC 2 on a provider page is not a promise that your auditor accepts the report.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [RunSybil](https://pentestcompare.com/providers/runsybil/) | Autonomous testing platform | automated | yes | yes | yes | unknown | custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and shows a replay button on findings. | on request |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |

## What does the SOC 2 framework ask for?

SOC 2 does not require a penetration test. It is an attestation against the AICPA Trust Services Criteria, which set objectives and leave the choice of controls to the company. Penetration testing appears once in the 2017 criteria (March 2020 update), as an example under CC4.1: "Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments."

The criteria also say that "Use of the trust services criteria does not require an assessment of whether each point of focus is addressed." AICPA revised the points of focus in 2022, and the file needs a free account, so we quote the 2017 text. The full requirement text and what it means for scoping are on [SOC 2 penetration testing at penetrationtestservices.com](https://penetrationtestservices.com/soc-2-penetration-testing/). Our own comparison of how providers describe this is in the guide [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/).

## Who needs a SOC 2 pentest, and when?

You are likely to need one when an auditor or an enterprise customer asks for a recent third-party report. Linford & Co, a CPA firm, writes that a pentest "is not required" because the specific controls are not provided by the criteria, yet many teams buy one as evidence. The usual triggers are a first audit, a customer questionnaire and a major release inside the audit period.

For a Type II audit, Top Floor Security advises running the test early in the period so the fix and the retest fall inside it. Treat that as a vendor view and confirm dates with your auditor.

## What should you ask SOC 2 pentest providers?

Ask for these six items in writing before you sign.

| Question | Why it matters |
|---|---|
| Can I send your sample report to my auditor first? | The auditor decides what evidence is enough. |
| Does the report state scope, dates and method? | These are the first things an auditor reads. |
| Does the report separate fixed and open findings? | A retest section shows closure evidence. |
| Do you issue a short letter for customers? | Customers often want a letter, not the full report. |
| What does the retest cover and how long does it run? | Compare the Retest column below with the quote. |
| Is the tester independent of the team that built the product? | Auditors weigh independence. |

Our guide [judge a pentest provider by its sample report](/guides/judge-a-pentest-provider-by-its-sample-report/) shows what to look for.

## What drives the price?

Price follows the number of applications, APIs and roles in scope, the depth of testing and the retest terms. Many providers quote after scoping. The "Published price" column shows a figure only where a provider lists one, so a blank price is a missing fact. See [penetration testing cost](/guides/penetration-testing-cost/) for the ranges we sourced.

## How do you read the table?

A provider appears when its own pages mention SOC 2. The mention can refer to the provider's own audit or to support for your audit, so click a provider name to see the source and the date we checked it. The Sample report column says whether a report is public, on request or not published. Providers sort A to Z, and no provider pays for a position. Read [how we compare](/methodology/) for the rules. For other frameworks, see [PCI DSS](/compliance/pci-dss/) and [ISO 27001](/compliance/iso-27001/).

## What does an auditor check in the pentest report?

Auditors read the report as evidence, and each wants something slightly different. A report that holds the items below saves a round of questions.

- The scope: systems, environments and the test window, with dates.
- The method and the standard used for severity.
- Findings with evidence, not a scanner export.
- The status of each finding after the retest.
- The name of the testing company and a statement of independence.

No provider can promise that an auditor accepts its report. Ask your auditor which of these items it needs.

## Questions

### Do I need a pentest for SOC 2?

The criteria do not require one. Penetration testing appears once in the 2017 criteria, as an example evaluation under CC4.1. Auditors set their own evidence standard, so ask yours what it expects before you scope a test.

### Will my auditor accept any provider's report?

No rule makes an auditor accept a given provider, and no provider can promise it. Send the sample report and scope statement to your auditor first and keep their reply.

### When should the test happen in a Type II audit?

Top Floor Security, a testing vendor, advises running the test early in the audit period so the fix and the retest also fall inside it. That is a vendor view. Confirm the dates with your auditor.

### Is a vendor's own SOC 2 report the same as a SOC 2 pentest?

No. A provider's SOC 2 report covers the provider's own controls. A pentest of your product is evidence for your report. The table shows what each provider states about SOC 2, which is not the same thing.

## Sources

- [AICPA TSP 100, 2017 Trust Services Criteria (March 2020 update), copy hosted by Arpio](https://arpio.io/wp-content/uploads/2020/08/trust-services-criteria.pdf)
- [AICPA: 2017 Trust Services Criteria with revised points of focus, 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)
- [Linford & Co: What is penetration testing for SOC 2?](https://linfordco.com/blog/what-is-penetration-testing-soc-2/)
- [Top Floor Security: Does SOC 2 require a penetration test?](https://topfloorsecurity.com/insights/does-soc-2-require-a-penetration-test/)
- [PentestCompare provider dataset (each row links to its provider sources)](https://pentestcompare.com/methodology/)