Best SOC 2 Penetration Testing Providers in 2026: What Auditors Accept

SOC 2 does not say “penetration test” anywhere in the Trust Services Criteria. What it has is CC4.1 (monitoring activities) and CC7.1 (detecting vulnerabilities), and in practice every SOC 2 auditor expects a recent penetration test in the evidence for both. The question a buyer actually faces is narrower than “who is the best pentest firm”: it is who produces a report the auditor accepts without a follow-up question, on a timeline that fits the audit window, at a price that does not surprise the CFO.

This list is written by a penetration testing company, so Invadel is first and this is our site. Descriptions of other firms are limited to what they publicly say about themselves, with no prices, because none publish any. Ours are on the pricing page.

What the SOC 2 auditor needs from the report

Our SOC 2 penetration test requirements guide covers this in depth. The short list:

1. Scope that matches the system description. If the SOC 2 covers the production SaaS environment, the test covers the production SaaS environment, including the cloud account it runs in.
2. Dates inside the audit period. A Type II report covers a period, typically six to twelve months; the test has to fall inside it, or the auditor will ask for one that does.
3. Methodology stated. Which standards the test followed (OWASP, PTES) and whether it was manual.
4. Findings with severity and remediation status. Auditors want to see that criticals were fixed and retested, which is why the retest report matters as much as the original.
5. An attestation letter. A one-page summary the auditor can drop into the workpapers: what was tested, when, by whom, against what standard, and the result.

The SOC 2 evidence checklist lists every document to hand over.

Where SOC 2 buyers find vendors

Most companies pursuing SOC 2 now run it through a compliance automation platform, and those platforms maintain partner directories of penetration testing firms: Vanta’s Find a Partner directory, Drata’s service partners, Secureframe’s Trusted Partners, Sprinto’s partner network. A listing there means the platform has onboarded the firm and knows its reports fit the evidence workflow. It does not rank the firms; that is what this page is for.

The best SOC 2 penetration testing providers in 2026

1. Invadel

Best for: a fixed-price test with the report and attestation letter written for the SOC 2 auditor.

Every Invadel report carries a SOC 2 mapping section that ties each finding to the Trust Services Criteria it affects, plus the attestation letter above. Testing is manual, performed by a senior in-house team, scheduled to land inside your audit period, and the retest of remediated findings is included at no charge, so the evidence set arrives complete. Prices are published: web application tests from $5,200, external network from $4,200, with the full list on the pricing page and the framework detail on our SOC 2 penetration testing page. The honest limitation: we do not perform the SOC 2 audit itself. The assessors who do are on our cybersecurity audit companies list.

2. A-LIGN

Best for: buying the penetration test and the SOC 2 audit from one firm.

A-LIGN is a licensed CPA firm that performs SOC 2 attestations and also offers penetration testing through a separate practice, with the independence separation the standard requires. One vendor relationship, two teams.

3. Rhymetec

Best for: startups pairing penetration testing with vCISO and compliance services.

A compliance-focused security firm serving startups and growth-stage SaaS companies, offering penetration testing alongside virtual CISO and SOC 2 readiness work, and a frequent name in the compliance platforms’ partner directories.

4. Cobalt

Best for: PTaaS with a fast start, integrated with compliance platforms.

A penetration-testing-as-a-service platform with a tester network, integrations with compliance automation tools, and a portal for findings and retests. Quick to schedule; depth depends on who is assigned. See Invadel vs Cobalt.

5. Software Secured

Best for: SaaS companies that want a developer-friendly testing relationship.

A boutique focused on application security for software companies, with SOC 2 among the compliance drivers it serves. See Invadel vs Software Secured.

6. BreachLock

Best for: platform-driven testing with continuous retesting through a portal.

A PTaaS provider combining automation and human validation, with compliance-mapped reporting. See Invadel vs BreachLock.

7. Vumetric

Best for: fixed-scope compliance-driven testing from a Canadian firm.

A penetration testing firm with fixed-scope engagements and compliance-oriented reporting. See Invadel vs Vumetric.

8. Raxis

Best for: US companies that want a traditional manual test with a straightforward report.

A US penetration testing firm offering manual testing and a PTaaS option, with SOC 2 among the frameworks it reports against. See Invadel vs Raxis.

9. Packetlabs

Best for: manual-first testing with detailed reporting.

A manual-first Canadian firm whose reports are built for compliance audiences. See Invadel vs Packetlabs.

10. Astra Security

Best for: companies that want a scanning platform with a pentest option and compliance dashboards.

A vulnerability scanning platform with penetration testing services layered on top and compliance views inside the product. See Invadel vs Astra Security.

How to buy this without a surprise

• Book the test for the middle of the audit period, not the end. Remediation and retest take weeks; the evidence has to be complete before fieldwork.
• Ask whether the retest is included. A test with a critical finding and no retest is an open finding in the SOC 2 report.
• Ask to see the attestation letter format. If the vendor does not know what that is, the auditor will be writing you follow-up questions.
• Fix the price before the scoping call. SOC 2 tests are the most commoditized purchase in security and still routinely arrive as day-rate estimates. See how much a penetration test costs.
• Get the sample report. Ours is on the sample report page.

Frequently asked questions

Does SOC 2 require a penetration test? Not by name. The criteria require vulnerability identification and monitoring, and auditors treat a penetration test as the standard evidence. See SOC 2 penetration test requirements.

How often? At least annually, inside each audit period, and after significant changes to the in-scope system. See how often you should do a penetration test.

Can a vulnerability scan replace it? Most auditors will accept a scan as part of the evidence and still ask where the penetration test is. See penetration testing vs vulnerability scanning.

Can the same firm do the test and the audit? Some firms offer both through separate teams. Many companies use two vendors so nobody grades their own homework.

The short version

Choose a provider whose report is written for the auditor, whose retest is included, and whose price is known before the call. If that is what you want, scope a SOC 2 penetration test.