SOC 2 penetration testing

A SOC 2 pentest your auditor and your customers can actually use.

Your auditor asked for one, a customer's security review is stuck on it, or your own policy says you test every year. We run manual, senior-led penetration testing against the systems in your SOC 2 scope and hand back a report built for engineers and auditors alike. Fixed price, remediation retest included.

Scope a SOC 2 pentest What we need from you
When it comes up

Where a pentest fits in SOC 2

SOC 2 doesn't hand you a checklist that says "run a penetration test." The Trust Services Criteria describe outcomes, and your auditor decides what evidence shows your controls work. In practice, a recent pentest is one of the most common pieces of evidence teams bring to the monitoring (CC4) and system operations and vulnerability management (CC7) criteria.

It usually lands on your desk one of these ways:

  • Your auditor or readiness assessment flagged it. They want independent testing of the in-scope system before the audit window closes.
  • Your own policy requires it. If your security policy says "annual third-party penetration test," the auditor will test that control. No report, no control.
  • A customer asked for it. Enterprise security questionnaires routinely ask for a recent pentest report or summary, with or without a SOC 2 report.
  • There's a date on the calendar. A renewal, a deal, or an audit window. Tell us the date and we'll plan the test around it.

Whether you need one, and how often, is between you and your auditor. We'll help you scope a test that answers the question they're asking.

What we test

The systems in your SOC 2 scope

We start from your system description, not a generic target list, so the test lines up with what your auditor is reviewing.

Web application

The product your customers log into. Access control, injection, session handling, file handling, and the business logic scanners can't follow.

Authenticated · Multi-role

APIs

REST and GraphQL endpoints behind the app and any public API you ship. Broken object level authorization, mass assignment, and auth flaws.

REST · GraphQL · Webhooks

External perimeter

Everything internet-facing that supports the service: exposed hosts, admin panels, forgotten subdomains, and weak service configs.

Network · Services · DNS

Cloud configuration

IAM, storage, network exposure, and logging across AWS, Azure, or GCP, focused on paths to customer data.

AWS · Azure · GCP

Mobile apps

If your iOS or Android app is part of the service, we test it and the APIs it talks to. More on mobile →

iOS · Android · MASVS

GenAI features

AI features that touch customer data get tested for prompt injection, data exfiltration, and guardrail bypass.

Chatbots · RAG · Agents
Authenticated testing

We test it logged in, at every role

Most of what matters in a SaaS product lives behind the login. An unauthenticated scan of your login page tells your auditor very little. We test with real accounts at each permission level, and across tenants if your product has them, so we can answer the questions your customers care about: can one customer see another customer's data, and can a regular user do what only an admin should?

You give us test accounts in a staging or production-like environment. We agree on rules of engagement before anything starts.

01
Tenant isolation

Cross-account access to records, files, and API objects.

02
Privilege boundaries

Role escalation, admin functions exposed to regular users.

03
Business logic

Workflows abused in ways no scanner would try.

Deliverables

What you get

The report
  • Executive summary your leadership, auditor, and customers can read
  • Scope, testing dates, and methodology, stated plainly
  • Each finding with severity, evidence, reproduction steps, and real-world impact
  • Prioritized remediation guidance written for the engineer closing the ticket
Remediation retest

Fix what we found, and we retest it. Retests are included within 90 days of report delivery, and the final report is updated to show which findings are closed. That updated report is usually what you want to hand your auditor or customer.

To be clear about what a pentest report is: it's evidence. It shows a qualified third party tested your system and what they found. It does not decide your audit. Your auditor does that.

Scoping

What we need to scope it

Send what you have. Rough answers are fine for a first pass, and we'll come back with a scope, a timeline, and a fixed price.

  • Your SOC 2 scope. The system description or a list of in-scope applications, environments, and cloud accounts.
  • The driver and the date. Audit window, customer review, or policy, and when you need the report.
  • Application size. Number of user roles, rough count of pages or API endpoints, and any API docs (OpenAPI, Postman, GraphQL schema).
  • External footprint. Domains and IP ranges you own that support the service.
  • Cloud. Providers and number of accounts or subscriptions, if cloud review is in scope.
  • Environment. Staging or production, plus any testing windows or systems that are off limits.
  • Prior reports. Last year's pentest, if you have one, so we can confirm old findings are closed.
FAQ

SOC 2 pentest questions

Does SOC 2 require a penetration test?
Not explicitly. The SOC 2 criteria don't mandate a pentest, but many auditors expect independent testing as evidence for monitoring and vulnerability management controls, and many customers ask for one in security reviews. If your own policy commits to annual testing, your auditor will expect to see it. Ask your auditor what they want to see, then we can scope to it.
Will your report get us through our audit?
No pentest firm can promise that, and you should be wary of one that does. Your auditor evaluates your controls as a whole. What we give you is a clear, credible report of what was tested, what we found, and what you fixed, which is the evidence auditors and customers typically ask for.
How fast can you start?
For a scoped single-app engagement we can usually kick off within one to two weeks, faster if you're up against an audit window or customer deadline. Tell us the date up front and we'll plan the test, report, and retest around it.
Do findings need to be fixed before the audit?
That depends on your auditor and your own remediation policy. Most teams want high and critical findings closed, or at least tracked with a plan. The included retest lets you show which findings are fixed, with the report updated to match.
Should we test production or staging?
Either can work. Staging is common for authenticated application testing as long as it matches production closely. External perimeter testing usually targets production. We'll agree on environments, windows, and anything off limits before testing begins.
Is the price fixed?
Yes. Once we've scoped the work you get a fixed price, and the remediation retest is part of it. We'll also sign your NDA and MSA before any testing begins.

Got an audit or a deadline coming up?

Send us your SOC 2 scope and your date. We'll come back with a scope, a timeline, and a fixed price.

Email info@mavericksecurity.ai Scope it yourself first