Schedule A Meeting
Schedule A Meeting

SOC 2 Type II Penetration Testing

Human Led + AI Testing

Penva Security tests the real attack paths behind your SOC 2 security controls, giving management and your CPA auditor clear evidence that vulnerabilities are being identified, prioritised and fixed.

The engagement covers the application, APIs, cloud services and access controls in scope. You receive a practical report, a signed attestation letter and a remediation retest that can be retained with your Type II evidence.

Book a Free Scoping Call with US
  • Certified Testers
  • Security Compliance
  • Manual Pentesting
Pentest Report SCANNING COMPLETE
SOC 2 Security Evidence
scope: production service · CVSS 3.1
Critical 3
High 6
Medium 9
Report + independent test evidence generated
Turn technical findings into SOC 2 audit evidence.
Get Instant Quote
Instant estimate in about 30 seconds
CREST + OSCP testers SOC 2 evidence 100% Australian
Definition

What Is SOC 2 Type II Penetration Testing?

SOC 2 Type II penetration testing is an independent technical assessment used to support the controls operating across your audit period. It shows how your service stands up to realistic attacks and gives your auditor evidence beyond policies, screenshots and automated scan results.
A Type II examination looks at whether controls operated effectively over time. A penetration test supports that story by testing access restrictions, internet-facing systems, cloud configurations, tenant separation and the way security weaknesses are handled after discovery.

The test does not replace the SOC 2 examination performed by a licensed CPA firm. It gives management a credible body of security evidence that can be mapped to the Trust Services Criteria and supplied during readiness work or the formal audit.

Requirements

What SOC 2 Type II Auditors Look For

Penetration testing most often supports the common criteria covering risk identification, access protection, vulnerability management, monitoring and corrective action.

CC3.2

Identify Security Risks

Real attack testing helps management identify threats and vulnerabilities that may affect the service, its customers or the commitments described in the system description.
CC5.2

Technology Control Activities

Testing checks whether technical safeguards are implemented in a way that addresses the risks they were designed to manage.
CC6.1

Logical Access Controls

Authentication, authorisation, privileged access and tenant boundaries are tested to confirm that users can reach only the systems and data they are permitted to use.
CC6.6

Protection from External Threats

Internet-facing applications, APIs, cloud services and network boundaries are assessed against realistic external attack techniques.
CC7.1

Vulnerability Identification

Findings provide evidence that security weaknesses are detected, assessed and prioritised before they become a customer-impacting incident.
CC7.2

Monitoring and Response

Attack paths and observable events help teams confirm that security monitoring, escalation and response processes cover meaningful threats.
How Penva Delivers

Evidence Your SOC 2 Auditor Can Use

Every engagement is structured so the technical work can be retained as clear, traceable evidence during readiness and the Type II examination.

CC3.2 Threat-Based Risk Evidence

A concise risk narrative showing the tested threat, affected asset, exploit path, business impact and recommended treatment.

CC6.x Access and Boundary Testing

Hands-on testing of authentication, roles, APIs and tenant separation, with screenshots and reproducible evidence for each confirmed weakness.

CC7.1 Vulnerability Management Evidence

A prioritised penetration test report using CVSS 3.1, CWE and OWASP references, suitable for your control evidence library.

Corrective Action Remediation Verification

One remediation retest within 60 days and an updated report confirming whether each agreed fix is effective.

Audit Support Independent Attestation

A signed attestation letter recording the tester, credentials, scope, dates and methodology so your auditor can understand the independence and quality of the work.
Instant Estimate Quote

Get an Instant Penetration Testing Estimate

Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.

Quote Builder Step 1 of 6
5 steps left
01

What type of penetration testing do you need?

Choose the main service you want quoted.

FAQ

SOC 2 Type II Penetration Testing - Common Questions

Practical answers for service organisations preparing for a SOC 2 Type II examination. Updated July 2026.

Does SOC 2 Type II require a penetration test?

The Trust Services Criteria do not prescribe one named testing method for every service organisation. In practice, a penetration test is widely used to demonstrate that technical vulnerabilities and access-control weaknesses are identified and managed. Your final evidence requirements should still be agreed with your SOC 2 auditor.

What is the difference between SOC 2 Type I and Type II?

A Type I report considers the design of controls at a point in time. A Type II report also examines whether those controls operated effectively over a defined period. A current penetration test is useful for both, but the Type II audit will also look at how findings were tracked and resolved during the review period.

When should we schedule the test?

For a first audit, testing before the observation period gives your team time to fix material findings. It is also sensible to test after major releases, architectural changes or the introduction of a new internet-facing service. Your auditor can confirm the preferred evidence window.

Which systems should be included in scope?

The scope should follow the system boundary in your SOC 2 description. It commonly includes the customer-facing application, APIs, cloud environment, identity services, administrative functions and any component that can materially affect the commitments made to customers.

Can our SOC 2 auditor rely on Penva’s report?

Your CPA auditor decides what evidence is sufficient for the engagement. Penva provides a structured report, reproducible evidence, tester credentials, scope and methodology details so the auditor can evaluate and use the work appropriately.

How often should a SOC 2 organisation run penetration testing?

Annual testing is common, with additional testing after significant changes or serious incidents. A fast-moving SaaS environment may need more frequent assessments because the risk profile changes throughout the Type II period.

Is remediation retesting included?

Yes. Fixed-price engagements include one retest within 60 days. We repeat the relevant exploitation steps, record the result and issue an updated report that can be retained as corrective-action evidence.

Get In Touch

Schedule a Call Today

Contact us