SOC 2 penetration testing providers: what to compare

SOC 2 penetration testing providers differ in what they publish: some name SOC 2 on their pages, some show a sample report, some list credentials, and most leave auditor acceptance to you. No provider can promise that your auditor will accept its report. This page shows what the SOC 2 criteria say, which provider fields matter for audit evidence, and which documents to request. Facts come from the PentestCompare dataset, checked on 9 November 2026.

Does SOC 2 require a penetration test?#

No. SOC 2 is an attestation against the AICPA Trust Services Criteria (TSC). The criteria set objectives, and a company picks controls to meet them. The 2017 criteria (March 2020 update) say that "Use of the trust services criteria does not require an assessment of whether each point of focus is addressed."

Penetration testing appears once, as an example. Under CC4.1, the point of focus "Considers Different Types of Ongoing and Separate Evaluations" reads: "Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments."

CC7.1 asks the entity to use "detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities." Its point of focus covers vulnerability scans and does not name pentests.

We quote the 2017 text as hosted in a third-party copy. AICPA also publishes a 2022 revision of the points of focus behind a free login, and we have not read it. Its wording may differ. Linford & Co, a CPA firm, writes that a vulnerability scan or penetration test "is not required" to meet the Trust Services Criteria for a SOC 2 report and that "The specific controls that must be met are not provided by the AICPA Trust Services Criteria." In practice, auditors and customers commonly ask for a recent third-party pentest report. That is common practice, not a rule.

What do auditors and compliance tools ask for?#

Compliance platforms show what evidence they collect. Drata's control DCF-19 asks you to "Upload evidence of the most recent penetration testing activities". Vanta describes findings with "severity, steps to reproduce, and recommendations for remediation" and says "a retest can confirm vulnerabilities have been resolved". These are platform help pages, not audit rules.

Your auditor decides what is enough. Ask the auditor three things before you buy: whether a pentest is expected, what tester independence they want, and what the report must contain.

Which provider fields matter for SOC 2 evidence?#

The dataset has five fields that bear on audit evidence. The table shows them for providers whose pages mention SOC 2. Excession Labs is the publisher and appears as one row.

Two cautions apply. First, a provider's own credentials describe the provider, not your audit. A provider's SOC 2 report covers its own controls. Second, the dataset records the SOC 2 mention as marketing text. XBOW's page lists SOC 2 and other frameworks without making clear whether XBOW holds the certification or supports the framework.

Pen Test Partners, Horizon3.ai and Terra Security do not name SOC 2 in the dataset. Terra lists a SOC 2 Type II badge among its credentials but names no frameworks on its page.

What evidence should you request from a provider?#

Ask for these documents. Each answers a question your auditor may ask.

The PCI SSC Penetration Testing Guidance (v1.1, September 2017) says its report outlines "are only suggested outlines and do not define specific reporting requirements for PCI DSS penetration tests." SOC 2 sets no format either, so agree the contents with your auditor.

An attestation letter is a vendor document. Vendors that sell letters say acceptance varies, so never treat a letter as auditor-approved. TurboPentest and Parameter mention letters or auditor-mapped reports on their pages. Ask your auditor if it accepts them.

How should timing work for a Type II audit?#

A Type II audit covers a period. Top Floor Security, a testing vendor, advises running the test early in the period so the fix and retest also fall inside it. That is a vendor view. Choose a provider that publishes a retest window you can use inside your period. For example, Cobalt, Aikido and HackerOne publish windows of months or weeks. Confirm dates with your auditor.

How should you compare providers for SOC 2?#

Send the same scope summary to each provider. Then compare the documents above, not the badges. A short list might hold one automated provider, one platform and one consultancy, so you see the range of evidence each delivery type gives. The sample report guide shows how to read the samples. The cost guide shows what each model costs.