Penetration testing evidence for your SOC 2 report

What SOC 2 asks for — and where penetration testing fits

SOC 2 is not a certification. It is an attestation report, written and signed by a licensed CPA firm, on how your controls map to the AICPA Trust Services Criteria — the 2017 criteria, still current, with their points of focus revised in 2022. Nowhere in those criteria is a penetration test named as a required control. It appears once, as one example among several kinds of evaluation management can run. That single mention is why almost every SOC 2 audit includes one anyway.

A Type I report describes whether your controls are suitably designed on one specific date. A Type II report says whether they operated effectively across an observation period, usually three to twelve months. For a Type I, a recent test report is normally enough. For a Type II the auditor is sampling a window — and a single test dated four weeks before that window opened says nothing about the months that follow it.

CC4.1 — Monitoring activities. Management is expected to run ongoing and separate evaluations confirming that internal control is present and working. The points of focus list the options: internal audit, compliance assessments, vulnerability scans, security assessments and penetration testing. It is a menu, not a mandate — and penetration testing is the item on that menu an auditor recognises fastest.

CC7.1 — Detection. You have to detect configuration changes that introduce new vulnerabilities, and identify newly discovered ones in your components. Scanning satisfies the letter of it. Testing that chains findings into a working exploit is what tells you which of those vulnerabilities actually matters.

Depending on your scope, the access-control criteria in CC6 and the incident criteria in CC7.2 also lean on testing evidence: controls that resist real attempts to bypass them, and anomalies that get detected rather than logged and ignored.

Most SOC 2 programmes do not start with a security goal. They start with an enterprise prospect whose procurement team will not sign without the report. That deadline is what shapes the testing decision: teams book the cheapest test that closes the gap, get a PDF, and find out at the Type II that the auditor wanted evidence across the whole period rather than one dated document.

Scope and methodology, the qualifications of the testers, each finding with its severity, the date it was remediated, and evidence that the fix was retested and held. For a Type II, dates matter more than anything else: the auditor is checking that your evidence covers the observation window, not only its edges.

Strike does not issue SOC 2 reports and never will — only a licensed CPA firm can. What Strike delivers is the technical evidence behind them: continuous penetration testing executed by AI with expert human validation before customer delivery, retesting whose availability depends on the subscribed scope, and a dated evidence trail that runs the length of your observation period instead of stopping after one engagement.

Strike-reported metrics on this page: 97% precision / 3% false positives. That is a figure Strike reports about its own platform, not a third-party benchmark; the scope, definition and measurement dates behind it are set out in how Strike measures results.

SOC 2 and penetration testing, answered

Does SOC 2 require a penetration test?

No. The Trust Services Criteria never list one as a required control. Penetration testing appears as one example of the evaluations management may run under CC4.1, alongside vulnerability scans, internal audit and compliance assessments. In practice most auditors ask for one, and most buyers reading your report expect to see it. Source: AICPA, 2017 Trust Services Criteria (With Revised Points of Focus – 2022) (accessed 28 July 2026); downloading this document requires a free AICPA account.

Type I or Type II — what changes for the testing?

Type I examines control design on a single date, so a recent test report usually satisfies it. Type II examines operating effectiveness across three to twelve months, so the auditor wants evidence spread across that window. That is exactly where an annual test starts to fall short and continuous testing starts to pay for itself.

What evidence do I actually hand the auditor?

The report itself, plus scope, methodology, tester qualifications, severity ratings, remediation dates and retest evidence. If your findings show up as fixed and re-verified with dates that fall inside the observation period, the conversation is short.

When should we run the testing?

Before the observation period opens if you are heading into a Type II, and then continuously through it. Testing only at the end leaves the earlier months unevidenced, and a critical finding discovered late turns into a remediation scramble against your report date.

Does Strike issue the SOC 2 report?

No. SOC 2 reports are issued by licensed CPA firms after their own examination. Strike supplies the penetration testing evidence, the retest records and the documentation that supports audit and compliance programs, which the examination relies on.

How much does it cost and how long does it take?

Strike is a continuous subscription scoped to your attack surface rather than a fixed-price project, so cost follows scope and assets. Setup takes under 5 minutes once the target information and access are ready, and initial findings typically arrive within 1–2 hours of testing beginning, for supported scopes — fast enough to matter when a deal is waiting on the report.