SOC 2 penetration testing: what auditors ask for, and what it costs in the US
A SOC 2 report is an auditor's opinion against the AICPA Trust Services Criteria. A penetration test is commonly filed as evidence for CC4.1, monitoring activities, and CC7.1, detecting vulnerabilities. The AICPA puts the current criteria text behind a login, and we have not read it, so this page does not tell you the criteria name a penetration test or that they do not. What we can source: nine US-market providers publish a price for a pentest on a page that names SOC 2, from USD 2,750 for a fixed plan. Matproof Sentinel costs EUR 149 per run and uses AI agents only. Your auditor decides whether any report is enough.
Where a penetration test fits in a SOC 2 audit
SOC 2 is not a checklist of controls. Your service auditor tests the controls you describe against the Trust Services Criteria and gives an opinion. Two criteria come up whenever a penetration test is discussed: CC4.1, on monitoring activities, and CC7.1, on detecting vulnerabilities. A dated test report, with proof that the findings were fixed, is common evidence for both. Whether your auditor expects one, and how often, is agreed in your audit, not on a vendor page, ours included. A Type II report covers a period of time, so ask whether one test inside that period is enough or whether the auditor wants testing across it. The second reason teams buy a pentest is commercial: enterprise security questionnaires commonly ask for the latest report directly.
- Ask your auditor first. We could not read the AICPA criteria text, which sits behind a login, and we do not quote what we have not read.
- CC4.1 and CC7.1 are where a pentest report is usually filed as evidence.
- Type II covers a period. Ask whether one test inside the period is enough.
- Keep the retest. A finding with proof that it was fixed is stronger evidence than a finding alone.
- Price the scope, not the label. The published prices below range from USD 2,750 to USD 30,000 for different scopes.
What a SOC 2 penetration test should cover
- Web application security: OWASP Top 10 (2021), including broken access control, injection, cryptographic failures, security misconfiguration and insecure design.
- API security: OWASP API Security Top 10 (2023), driven by your OpenAPI spec, including broken object level authorization, broken authentication and excessive data exposure.
- Multi-tenancy isolation: authenticated testing with two identities to show that one customer cannot reach another customer's data.
- Authentication and sessions: MFA enforcement, session handling, JWT and API key security, and password policy.
- Infrastructure and configuration: TLS configuration, security headers, exposed services and known CVEs on your perimeter.
- Report: scope, method, CVSS ratings, proof of exploit and retest results, mapped to the criteria your auditor names.
Sample finding
Cross-tenant data access through a missing authorization check (multi-tenant SaaS)
Authenticated grey-box testing with two tenant accounts found that the /api/reports/{reportId} endpoint checked that the caller was logged in, but not that the report belonged to the caller's tenant. A user in tenant A could retrieve reports belonging to tenant B by supplying B's report ID. For a SaaS company preparing a SOC 2 report this is a logical access failure, and it is the issue an enterprise prospect's security team tests for before signing.
Fix: Enforce tenant-scoped authorization on every endpoint that references an object: confirm the requested resource belongs to the caller's tenant, ideally in one central authorization layer rather than per endpoint. Add automated tests that assert cross-tenant access is denied, then run the test again to confirm the fix before the audit period closes.
Reference: OWASP API1:2023 Broken Object Level Authorization · OWASP A01:2021 Broken Access Control · CWE-639
SOC 2 penetration testing options
| — | Free scan | Matproof Sentinel | Traditional consultancy |
|---|---|---|---|
| Automated scan engine | ✓ (3-min preview) | ✓ Full scan | ✗ Manual only |
| OWASP Top 10 coverage | Partial | ✓ Complete | ✓ Complete |
| Proof-of-exploit evidence | ✗ | ✓ Per finding | ✓ Per finding |
| Regulatory mapping (DORA/NIS2/ISO 27001) | ✗ | ✓ Automated | ✓ Manual |
| Audit-ready PDF report | ✗ | ✓ Instant | ✓ 2–4 weeks delivery |
| Continuous / recurring scans | ✗ | ✓ Per deploy | ✗ Annual engagement |
| Time to first result | ~3 min | ~30 min full scan | 2–4 weeks |
| Price | €0 | From €149 | €8,000–€25,000 |
| Source code review (SAST) | ✗ | ✓ On Growth plan | ✓ Scoped engagement |
| API testing (REST/GraphQL) | ✗ | ✓ Automated | ✓ Manual |
US-market providers that publish a price and name SOC 2 on the same page
Market: United States · Figures checked on 15 September 2026. Every row links to the page the number comes from.
| Scope | Published price | What it covers | Source |
|---|---|---|---|
| Bright Defense, fixed plans (Ignite, Elevate, Summit) | USD 2,750 / 5,250 / 9,250 | Web and API scope | Bright Defense, penetration testing plans |
| Stingrai, Autonomous Pentest | USD 3,000 one-time | One web app plus its APIs, AI agent | Stingrai, pricing |
| Stingrai, Hybrid Pentest | USD 6,800 one-time | AI agent with human pentesters | Stingrai, pricing |
| Intruder, AI pentest | USD 3,500 per test | Web applications, report stated as SOC 2 evidence | Intruder, pentest pricing |
| Aikido Security, typical pentest | USD 4,000 per assessment | Self-serve AI agents | Aikido Security, AI pentest |
| Strobes, PTaaS Standard | USD 4,800 | 5 credits, 1 target | Strobes, pricing (PTaaS tab) |
| CYBRI, Web Application package | From USD 5,000 | Remediation testing listed on larger packages | CYBRI, pricing |
| Packet33, web and API testing | USD 8,000 to USD 30,000 | Practitioner-led, fixed price per scope | Packet33, pentesting |
| Software Secured, PTaaS | From USD 21,400 | Human-led subscription | Software Secured, penetration testing as a service |
Each row is one provider's own list price, not a market average. Naming SOC 2 on a page is not an attestation, and no auditor has approved any of these reports in advance. Scope differs by row, so compare what is tested, not only the number.
Sources
- Bright Defense, penetration testing plans — No date shown on page, read 15 September 2026
- Stingrai, pricing — No date shown on page, read 15 September 2026
- Intruder, pentest pricing — No date shown on page, read 15 September 2026
- Aikido Security, AI pentest — No date shown on page, read 15 September 2026
- Strobes, pricing (PTaaS tab) — No date shown on page, read 15 September 2026
- CYBRI, pricing — No date shown on page, read 15 September 2026
- Packet33, pentesting — No date shown on page, read 15 September 2026
- Software Secured, penetration testing as a service — No date shown on page, read 15 September 2026
- AICPA, 2017 Trust Services Criteria (revised points of focus 2022). Login required, not read — Checked 15 September 2026
- Matproof pricing — Checked 15 September 2026
Matproof Sentinel for SOC 2
- 1 full pentest scan
- AI-prioritized findings with CVSS 3.1
- Proof-of-exploit per finding
- Audit-ready PDF report
- Regulatory mapping (DORA, NIS2, ISO 27001)
- 3 full Sentinel pentests per month
- Continuous monitoring
- CI/CD integration (GitHub, GitLab)
- All regulatory mappings
- Priority support
- 20 Sentinel pentests per month
- Extra scans at €149 each
- All 10 agents, including Cloud (Prowler) and Mobile (MobSF)
- Continuous schedules: hourly, daily or weekly
- Authenticated scanning (session cookies, bearer tokens)
- Webhook delivery and priority support
Frequently asked questions about SOC 2 penetration testing
Does SOC 2 require a penetration test?
Ask your auditor. SOC 2 is an auditor's opinion against the AICPA Trust Services Criteria, and the AICPA puts the current criteria text behind a login. We have not read it for this page, so we make no claim that it names a penetration test or that it does not. In practice auditors and enterprise customers commonly ask for a pentest report, usually as evidence for CC4.1 and CC7.1.
How much does a SOC 2 penetration test cost in the US?
Prices on providers' own pages that also name SOC 2, read on 15 September 2026: Bright Defense fixed plans at USD 2,750, 5,250 and 9,250; Stingrai USD 3,000 for an autonomous test and USD 6,800 for a hybrid test; Intruder USD 3,500 per test; Aikido Security USD 4,000 for a typical pentest; Strobes USD 4,800 for a standard pack; CYBRI from USD 5,000; Packet33 USD 8,000 to USD 30,000 for web and API testing; Software Secured from USD 21,400 for PTaaS. Matproof Sentinel is EUR 149 per run or EUR 299 per month. Many larger firms publish no price.
How often do I need a penetration test for SOC 2 Type II?
We cannot quote an interval from the criteria. A Type II report covers a period your auditor sets, and annual testing is the common baseline buyers ask about. If you deploy often, testing across the period gives the auditor evidence for the whole window rather than one day. Agree the cadence with your auditor before the period starts.
Is a vulnerability scan enough for SOC 2?
A scan and a penetration test answer different questions. A scan lists known issues by signature. A penetration test tries to exploit and chain them to show real impact, such as one customer reading another customer's data. Many auditors and buyers ask for both. Ask yours what they expect.
Will my auditor accept a Matproof Sentinel report?
We cannot promise that, and no provider can. A Sentinel report contains scope, method, findings with CVSS ratings, proof of exploit and retest results. It is produced by AI agents and checked by a second AI agent, with no human tester. Some auditors accept that as evidence and some want a named human tester. Ask before you rely on it.
Which US providers sell SOC 2 penetration tests?
Our comparison of penetration testing companies for US buyers lists 19 providers with published prices, retest terms, frameworks named and location, every value taken from the provider's own page: matproof.com/best-penetration-testing-companies-usa.
Go deeper — related blog articles
What a Matproof Sentinel report does not give your SOC 2 audit
Sentinel runs AI agents that test, and a second AI agent that re-runs each finding. That is the whole of it. Some auditors accept that as evidence; some want a named human tester. Ask yours before you rely on it.
- No human penetration tester. No tester's name or signature on the report.
- No promise that your auditor accepts the report. Nobody can make that promise for any provider.
- No social engineering, phishing simulation or physical testing.
- If your auditor or a customer contract asks for a human-led test, buy that engagement and use Sentinel between tests.
Get a current report for your auditor and your customers
Run a free scan to see what is exposed. A full Sentinel report costs EUR 149 per run, and a retest after you fix is part of the plan. Your auditor decides whether it is enough, and we will tell you when a human-led engagement is the better buy.
Run a free pentest scan