SOC 2 penetration testing

Prices start at $4,999. Buy online 

SOC 2 penetration testing is a manual security assessment of applications, APIs, cloud environments, and networks within your SOC 2 scope. Researchers simulate attacks to identify exploitable weaknesses and provide evidence for remediation, audit discussions, and customer security reviews.

Blaze's penetration testing services  assess authentication, authorization, tenant isolation, business logic, and infrastructure security. Your engineering team receives validated findings and practical fixes.

The AICPA Trust Services Criteria reference penetration testing as one example of an ongoing or separate evaluation under CC4.1. Testing can also support CC7.1 by identifying vulnerabilities in systems within scope.

Findings may inform other criteria covering access controls, boundary protection, and change management. A pentest does not independently demonstrate that all controls operated effectively throughout a SOC 2 Type II examination period.

Agree scope, timing, and expected evidence with your auditor. Allow time to remediate findings and complete retesting before the relevant evidence deadline.

Explore our SOC 2 penetration testing approach .

Testing is tailored to the systems supporting your service. Scope can include:

• SaaS and web applications
• APIs, including REST, GraphQL, SOAP, and gRPC
• AWS cloud environments and configuration
• iOS and Android mobile applications
• External and internal networks

Vulnerability scanning, secure code review, and Kubernetes assessments can complement the engagement where relevant.

Blaze is a CREST-accredited company. Our researchers hold certifications including OSCP, OSWE, OSCE, and CRTO.

Testing draws on applicable OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, PTES, and NIST SP 800-115 guidance. Researchers validate realistic attack paths and business impact before reporting.

We support SaaS, fintech, healthtech, and AWS-native businesses preparing for SOC 2 Type I and Type II examinations.

Assessment effort typically ranges from 5 to 25 person-days, depending on scope and complexity. Testing dates and report delivery are agreed during scoping.

You receive:

• Executive summary explaining key risks and business impact
• Technical report documenting scope, methodology, findings, and reproduction steps
• Severity ratings, remediation priorities, and correction guidance
• Relevant mapping of findings to the Trust Services Criteria
• Signed attestation letter documenting scope and assessment completion
• Re-test and free fix validation within 45 or 90 days, depending on package

Findings are shared through the Blaze Portal during testing, helping your team track remediation and coordinate with researchers. Final reports arrive within five business days of assessment completion.

Where scope and requirements overlap, evidence may also support ISO 27001, PCI DSS, and other assurance activities. Each framework retains its own obligations; your auditor determines evidence sufficiency.

Read our SOC 2 penetration testing requirements guide .

Prices start at $4,999, with discounts for early-stage startups. Final pricing depends on scope and complexity.

Talk to an expert about your SOC 2 pentest .

Email:  sales@blazeinfosec.com 

Phone: +1 347 892 4783 (US/Canada)

Phone: +351 222 081 647 (Europe/international)

Blaze is a CREST-accredited, ISO 27001 and ISO 9001 certified company, with worldwide professional liability (E&O) coverage of $5,000,000 through Hiscox.