COMPREHENSIVE WHITE-BOX PENETRATION TESTING
Fast. Affordable.
Thorough pen testing.
Fully valid, audit-ready evidence for SOC 2 Type I and Type II audits, delivered from comprehensive white-box testing by senior security engineers.
24 hours
Priority evidence window
White box
Full repository context
One report
Leadership to auditor
One retest
Dated, for the audit
START WITH YOUR AUDIT
What each framework actually requires.
Three name penetration testing outright. Most do not, and expect it anyway. Each page gives the clause and the careful answer.
Does SOC 2 require a pen test?
SOC 2 does not explicitly require a penetration test.
Trust Services Criteria CC4.1 and CC7.1
Does ISO 27001 require a pen test?
ISO 27001 does not use the words penetration test in the requirements of the standard.
Annex A 8.8 and Annex A 8.29
Does PCI DSS require a pen test?
Yes, explicitly.
Requirement 11.4
Does HIPAA require a pen test?
The HIPAA Security Rule as currently in force does not name penetration testing.
45 CFR 164.308(a)(1)(ii)(A) and 164.308(a)(8)
Start with what your audit requires
Three frameworks require a penetration test by name. Most do not, and expect one anyway. Each page gives the clause and the careful answer.
Trust Services Criteria CC4.1 and CC7.1
Does SOC 2 require a pen test?
SOC 2 does not explicitly require a penetration test. The Trust Services Criteria never use the phrase.
Annex A 8.8 and Annex A 8.29
Does ISO 27001 require a pen test?
ISO 27001 does not use the words penetration test in the requirements of the standard. Annex A 8.8 requires management of technical vulnerabilities and A 8.29 requires security testing in development and acceptance.
Requirement 11.4
Does PCI DSS require a pen test?
Yes, explicitly. PCI DSS Requirement 11.4 mandates a defined penetration testing methodology, internal and external penetration testing at least once every 12 months and after any significant infrastructure or application change, correction of exploitable vulnerabilities, and retesting to verify the fix.
45 CFR 164.308(a)(1)(ii)(A) and 164.308(a)(8)
Does HIPAA require a pen test?
The HIPAA Security Rule as currently in force does not name penetration testing. It requires an accurate and thorough risk analysis under 164.308(a)(1)(ii)(A) and a periodic technical and nontechnical evaluation under 164.308(a)(8).
NIST SP 800-53 Rev. 5 control CA-8 and the FedRAMP Penetration Test Guidance
Does FedRAMP require a pen test?
Yes. FedRAMP requires annual penetration testing performed by an accredited Third Party Assessment Organization, and the FedRAMP Penetration Test Guidance specifies the attack vectors that must be covered rather than leaving the methodology to the tester..
Trust Services Criteria CC4.1 and CC7.1
Does SOC 2 Type II require a pen test?
A Type II does not name penetration testing either, but the observation window changes the practical answer. The test needs to fall inside the window, and if findings were raised, the report reads far better when a retest inside the same window shows them closed..
What we test
Web application
Authenticated testing of a web application against the logic an attacker would actually abuse: who can reach what, whose data is whose, and what happens when a request arrives out of order.
API
Testing the API as the primary attack surface rather than as plumbing behind a user interface, including the endpoints the interface never calls.
Cloud infrastructure
Testing the cloud account itself: what an attacker reaches after one credential leaks, and how far identity and network configuration let them go.
External and internal network
Testing the network perimeter from outside, and the internal network as though a foothold has already been established. PCI DSS requires both; most other frameworks are satisfied with the external half.
AI and LLM features
Testing the AI surface of a product as a security surface: where untrusted content reaches a model, what the model is allowed to do with tools, and what a crafted input can make happen.
How an engagement runs
Five steps, and the parts that usually go wrong are called out rather than glossed over.
- 01
Scope in writing, not in a meeting
You state what is in scope, which environment, and what your audit needs. We confirm the price and the date. No discovery call is required to get a number.
- 02
Access on day one
Two accounts per role, two tenants, and a walkthrough of where the money and the data are. A tester blocked for a day has lost a fifth of the engagement.
- 03
Testing by a named engineer
Automation handles reconnaissance and evidence capture. A person decides what is real, what matters and how it is ranked, which is the part a scanner cannot do.
- 04
A report three audiences can use
Reproduction steps for engineers, impact in context for leadership, and scope, method, dates and closure for the auditor.
- 05
Remediation and a dated retest
One retest is included. The closed-loop record is usually worth more to the audit than the original findings, because it shows the control working.
Deciding between two things
SOC 2 vs ISO 27001
SOC 2 and ISO 27001 are the two assurance standards a growing software company is asked for. They overlap heavily in what they require and differ almost entirely in what they produce and who asks for them.
SOC 2 Type I vs Type II
The difference between the two SOC 2 report types is time, and that single difference changes cost, credibility and how you schedule a penetration test.
Penetration test vs vulnerability scan
The two are routinely confused, sometimes by vendors selling one as the other. They answer different questions and most compliance frameworks expect both.
Black box vs grey box vs white box testing
Black, grey and white box describe how much context the tester starts with. The choice changes what a fixed budget buys, and it is where the most money is wasted.
Recent writing
Audit operations · 5 min
The evidence worth generating before anyone asks for it
Audits fail on evidence far more often than on controls. The difference between a smooth audit and a scramble is whether records are produced as a byproduct of work or assembled by a person afterwards.
Audit operations · 5 min
Answering security questionnaires without losing a week each time
Security questionnaires are a tax on selling to enterprise, and most of the cost is re-answering the same questions in different formats. The fix is an evidence set assembled once, kept current, and mapped to the questions rather than to the forms.
AI security · 5 min
Your product has AI features. Does the audit care?
Neither SOC 2 nor ISO 27001 names AI. Both cover the system in scope, and an AI feature that is part of the product is part of that system. The practical pressure is arriving from enterprise questionnaires rather than from the frameworks.
Questions people ask
Does SOC 2 require a penetration test?
No. The AICPA Trust Services Criteria do not name penetration testing. A penetration test is the most common evidence used to satisfy CC4.1 and CC7.1, and most auditors expect security testing of some kind, but the requirement is for an evaluation showing controls are present and functioning rather than for a specific technique.
How much does a penetration test cost?
A comprehensive white box assessment starts at $900 and reaches $2,350 at the largest scope with priority delivery. Scope size and delivery speed are the only two inputs that move the price, and both are published.
How long does a penetration test take?
Testing runs three to five business days for a typical software product, with the report following. Priority delivery starts testing within 24 hours. Scope size drives the duration more than anything else.
Will the report work as audit evidence?
It states scope precisely enough to compare against a SOC 2 system description or an ISO 27001 scope statement, the dates testing ran, the method and access level used, and what happened to each finding including a dated retest. Those four things are what an auditor checks.