Your auditor asked for a penetration test, or your customers did. Zero Day Security runs manual tests scoped to your SOC 2 system description, with a report your auditor can drop into the evidence file and a free retest so findings show as closed, not just found.
SaaS companies preparing for a first Type I or Type II report, often because an enterprise deal depends on it.
Companies renewing a Type II report that need this year's test, remediation and retest inside the new observation period.
MSPs, data processors and teams using compliance automation platforms that have policy evidence in place but still need an independent third-party test.
Customer-facing apps and REST, GraphQL and WebSocket APIs, tested against the OWASP Top 10 and ASVS with emphasis on tenant isolation and access control.
The external perimeter of your cloud environment, plus internal network or cloud control plane testing where your system description includes them.
AI features that process customer data, tested against the OWASP Top 10 for LLM Applications for prompt injection, data leakage and unsafe tool use.
Covers ongoing and separate evaluations of whether controls are present and functioning. Its points of focus name penetration testing as one type of evaluation.
Covers detecting new vulnerabilities and configuration changes. A pentest, plus the retest, is direct evidence that those procedures work.
Type I: test before the report date. Type II: test early in the observation period so remediation and the retest also fall inside it.
Questions about a SOC 2 pentest? Email info@zerodaysecurity.net or book a free scoping call and bring your audit dates.
Auditors look for an independent tester, a documented methodology, a defined scope that matches the system description, severity-rated findings and evidence of remediation. The report is built around those points, and the retest documents fixes. If your auditor has specific requirements, such as a minimum scope or a summary for the evidence file, share them on the scoping call and the report will address them.
It should cover the systems that matter most to the trust services in your report, usually the customer-facing application, its APIs and the production environment behind it. Testing a marketing website while leaving the product untested won't satisfy an auditor. If the boundary is large, the scoping call helps you prioritize the in-scope systems that carry customer data and explain the rationale to your auditor.
SOC 2 doesn't set a frequency. Most auditors and customers expect a test at least annually, and again after significant changes such as a new product, a major architecture change or a cloud migration. For Type II reports, one test per observation period is the common pattern, timed early enough that the retest also lands inside the period.
Scans are useful and auditors will want to see them, but they don't replace a penetration test. Scanners miss access-control and business-logic flaws, such as one customer reading another's data, which are the issues customers care about most. A manual pentest validates which weaknesses are actually exploitable and provides the separate evaluation evidence that CC4.1 describes.
It starts with a free scoping call to agree targets, test windows and rules of engagement, and you receive a fixed price in writing. Testing is manual and non-destructive, and critical findings are reported immediately. The report includes an executive summary, CVSS-scored findings with evidence and remediation steps, and a methodology section for auditors. Once you've fixed the findings, a free retest confirms what's closed.
Every test is performed by a CREST-certified tester who also holds CREST CPSA, OffSec OSCP, OSWA, OSWP and OSAI, plus the HTB Certified Offensive AI Expert (COAE). All are practical, exam-based credentials. The same tester handles your engagement from scoping to retest, and every engagement is fixed-price with a free retest included.
Book a free scoping call. Tell us what you need tested and any deadline, and you'll get a clear fixed-price proposal.
Copyright © 2026 Zero Day Security - All Rights Reserved.
CREST CRT, OSCP, OSWA, OSWP, OSAI, COAE certified