Cybersecurity · Security Testing
The AICPA's Trust Services Criteria never name a penetration test — a SOC 2 examination reports on your controls, not on a checklist of products to buy. But when your auditor asks how vulnerabilities in your system are identified and addressed, a recent, retest-verified pentest report answers the question cleanly. This page is honest about the difference.
Independent quality engineering & cybersecurity since 2020 — 100+ security & quality engineers, delivering on platforms we build and run ourselves.
Audit evidence has a shelf life. A Type 2 report covers a review period — controls have to operate across it, not just exist on the day fieldwork starts — and a testing gap found mid-examination stalls the enterprise deal your SOC 2 report was supposed to unblock.
See a redacted sample report
The structure, depth, and remediation detail your team will receive — client identity and evidence removed.
SOC 2 does not strictly mandate penetration testing. The Trust Services Criteria are control criteria your auditor evaluates your system against — how you demonstrate them is between you and your auditor, and a pentest is the demonstration auditors most often ask to see when the topic is vulnerability identification.
Findings ranked by exploitability with reproduction steps, an executive summary written for non-engineers, and a final report your auditor can consume directly — scoped to the system your SOC 2 report describes.
Remediation is verified and the report updated to 'remediated and retested' — the wording auditors expect — so what your auditor sees is closure, not open risk.
A Type 1 report addresses control design at a point in time; a Type 2 covers operating effectiveness across a review period. We scope one-time assessments for a Type 1 and recurring cycles that keep evidence current across a Type 2 window and annual renewals.
01
A scoping call with the testers themselves — targets, rules of engagement, and what evidence you need out.
02
Manual assessment aligned to OWASP, PTES, and NIST SP 800-115, with daily contact for critical findings.
03
Findings ranked by exploitability and impact, each with reproduction and remediation guidance.
04
Verification of fixes and an updated report — the cycle then repeats on your release cadence.
Engagement
Buy it as a scoped project, embed it in your team, or run it as a managed service — same engineers, same governance, whichever shape fits.
A scoped, one-time assessment with a full report and one retest — for a release gate, a customer or audit requirement, or an annual baseline.
Recurring assessment cycles aligned to your release cadence, with retesting each cycle so the evidence stays current across surveillance audits.
Add an application, API, or environment to an existing program without re-contracting — scoped and started in days, not procurement cycles.
No — and a vendor who tells you otherwise is misquoting the framework. The AICPA's Trust Services Criteria don't prescribe specific security products or tests; a SOC 2 examination evaluates whether your controls meet the criteria, and your auditor decides what evidence demonstrates that. In practice, auditors regularly ask how vulnerabilities are identified and addressed, and a recent penetration test with verified remediation is the clearest way to answer.
It depends on the report type. A Type 1 examination addresses control design at a point in time, so a completed pentest with retest before that date is what matters. A Type 2 covers operating effectiveness over a review period, so testing should land inside the window — and a standing program keeps evidence current across annual renewals instead of restarting the scramble each year.
Yes. Remediation of reported findings is verified and the report updated to 'remediated and retested' — the wording auditors expect. Retest scope and window are set in the engagement agreement.
Senior engineers from our own bench — 63% hold industry certifications (CISSP, CEH, eCPPT, ISTQB, AWS). The people who scope your engagement are the people who run it; there is no rotating offshore bench behind the proposal.
Engagements run under NDA, and engineers who handle client data undergo background checks. Findings and reports are shared through channels agreed at scoping and are not retained beyond the period needed to deliver and support the engagement. Data-handling specifics — storage, encryption, retention, and destruction — are documented in your service agreement; see the Trust page for our posture.
This is one stage of a single assurance loop: findings become regression tests, and their indicators become live detections — so a problem, once fixed, can’t quietly come back. That’s what you get from one integrated partner that a stack of separate vendors can’t. See how the loop connects →
A 30-minute call with the engineers who will do the testing — not a sales gate.