Short answer: No. SOC 2 has no explicit requirement for a penetration test. SOC 2 is built on criteria, not a fixed list of controls, and the Cloud Security Alliance notes there are no explicit requirements for penetration testing, or any specific control, in a SOC 2 report. In practice most companies get one anyway, because a pentest is strong evidence for criteria such as CC4.1 (evaluating whether controls work) and CC7.1 (detecting vulnerabilities), and because enterprise customers frequently ask for a recent pentest report before signing.
SOC 2 reports are assessed against the AICPA Trust Services Criteria. Two criteria are commonly supported by penetration testing:
Your auditor decides what evidence satisfies each criterion for your system. A vulnerability scan alone is usually treated as weaker evidence than a pentest that shows whether issues are actually exploitable.
Scope the pentest around the systems in your SOC 2 boundary:
Agree targets, exclusions, testing windows, and rules of engagement in writing before testing begins.
Test once the production system and controls are in place, before or during your SOC 2 observation period, so the results and fixes fall within it. Most teams then retest after significant changes and at least annually, in line with what customers typically request.
Keep the report and evidence of remediation together. Auditors and customers care as much about how findings were handled as about the findings themselves.
An AI-assisted pentest can provide the same evidence as long as the report shows a defined scope, real exploitation evidence, and accountable human review of the findings. A fully automated scan with no human validation is closer to a vulnerability scan. See what AI penetration testing is.
Firepan Pentest is an AI-assisted, human-reviewed penetration test of an agreed Web2 scope: websites, applications, APIs, authentication, integrations, cloud, and network assets. The reviewed report states what was tested, what was excluded, the findings and evidence, and remediation guidance; a retest is included when it is part of the agreed scope. Each engagement is quoted for its scope. A Firepan Pentest report can support SOC 2 readiness and customer security reviews; it is not a SOC 2 certification. For typical market prices, see penetration testing cost.
Q: Does SOC 2 require a penetration test?
A: Not explicitly. SOC 2 does not mandate specific controls. A pentest is commonly used as evidence for criteria such as CC4.1 and CC7.1, and many auditors and enterprise customers expect one.
Q: Is a vulnerability scan enough for SOC 2?
A: Scans help with ongoing vulnerability management, but they do not show whether issues are exploitable. Many auditors and customers treat a pentest as stronger evidence.
Q: How often should we pentest for SOC 2?
A: At least annually and after significant changes is the common practice, and it matches what customers usually request. Your auditor and contracts set the actual expectation.
Q: Does a pentest report make us SOC 2 compliant?
A: No. It is one piece of evidence. SOC 2 compliance comes from an independent auditor's assessment of all your controls against the Trust Services Criteria.
Q: Can Firepan provide a pentest for SOC 2?
A: Yes. Firepan Pentest provides an AI-assisted, human-reviewed test of an agreed scope with a reviewed report that can support SOC 2 readiness. Request a scope discussion at firepan.com/pentest.
Firepan
Run a free scan — results in minutes, no credit card required.
Run Free Scan →Published 2026 ranges put a web application pentest at roughly $5,000 to $50,000. Here is what drives the price, how AI-assisted testing changes it, the red flags in cheap quotes, and what to send for an accurate quote.
AI penetration testing uses AI agents to plan and run parts of a security test — reconnaissance, hypothesis generation, exploit attempts. Here is what an AI pentest can find, where it stops, and how it applies to apps and smart contracts.
A vendor-neutral field guide to AI smart contract audit tools in 2026 — Firepan, Sherlock AI, Olympix, Almanax, Octane, V12, Nethermind AuditAgent, and QuillShield — with what each does, how they differ, and how to evaluate them on your own code.
A practical, step-by-step guide to running an AI smart contract audit: prepare the repository, run a free scan, read and triage findings, go deeper with an AI audit, and know when you still need human review.
Smart contract audits cost roughly $5,000 to $250,000+ in 2026, with most DeFi audits between $25,000 and $100,000. Prices by contract type, what drives cost, timelines, and cheaper ways to prepare.