Best SOC 2 Penetration Testing Providers in 2026: What Auditors Accept

SOC 2 does not require a penetration test. The Trust Services Criteria mention it only as one example of a separate evaluation under CC4.1 (monitoring activities), and CC7.1 covers detecting vulnerabilities. In practice every SOC 2 auditor expects a recent penetration test in the evidence for both. The question a buyer actually faces is narrower than “who is the best pentest firm”: it is who produces a report the auditor accepts without a follow-up question, on a timeline that fits the audit window, at a price that does not surprise the CFO.

This list is written by a penetration testing company, so Invadel is first and this is our site. Descriptions of other firms are limited to what they publicly say about themselves. Some of them now publish prices, and the table says which, but we never quote their figures. Ours are on the pricing page.

SOC 2 penetration testing providers compared

Provider	Delivery model	Published prices	Retest	Best for
Invadel	Manual testing by a senior in-house team	Yes	Free on every test	A fixed-price test with an auditor-ready report and attestation letter
A-LIGN	CPA firm with a separate testing practice	No	Per contract	Test and SOC 2 audit from one firm
Rhymetec	Compliance and security firm, testing plus vCISO	No	Per contract	Startups pairing testing with compliance help
Cobalt	PTaaS platform with a freelance tester community	Tiers only	Included in all tiers	A fast start inside a platform
Software Secured	Subscription testing by an in-house team	Yes	1 or 3 rounds, by service	SaaS teams testing through the year
BreachLock	PTaaS, automation plus human validation	Tiers only	1 or 2 manual retests, by plan	Platform-driven testing with a portal
Vumetric	In-house testing plus a PTaaS platform	No; self-service quote tool	Not stated	Compliance-driven testing from a US and Canadian firm, part of TELUS
Raxis	Manual testing plus a PTaaS option	Some figures	Included, requested in Raxis One	A traditional manual test
Packetlabs	Manual-first testing firm	No	Per contract	Manual-first testing with detailed reporting
Astra Security	Scanning platform with pentest tiers	Yes	Human re-scans by tier	Scanning plus a pentest option

Checked on each firm’s own site in September 2026. “Tiers only” means plans are listed without prices for manual tests; “Some figures” means a few services show indicative prices. “Per contract” means the retest terms are set in the quote, and “Not stated” means the firm’s site gives no retest terms, so in both cases ask before you sign.

What the SOC 2 auditor needs from the report

Our SOC 2 penetration test requirements guide covers this in depth. The short list:

1. Scope that matches the system description. If the SOC 2 covers the production SaaS environment, the test covers the production SaaS environment, including the cloud account it runs in.
2. Dates inside the audit period. A Type II report covers a period, typically six to twelve months; the test has to fall inside it, or the auditor will ask for one that does.
3. Methodology stated. Which standards the test followed (OWASP, PTES) and whether it was manual.
4. Findings with severity and remediation status. Auditors want to see that criticals were fixed and retested, which is why the retest report matters as much as the original.
5. An attestation letter. A one-page summary the auditor can drop into the workpapers: what was tested, when, by whom, against what standard, and the result.

The SOC 2 evidence checklist lists every document to hand over.

Vanta, Drata and Secureframe penetration testing providers

Most companies pursuing SOC 2 now run it through a compliance automation platform, and those platforms maintain partner directories of penetration testing firms: Vanta’s Find a Partner directory, Drata’s service partners, Secureframe’s Trusted Partners, Sprinto’s partner network. If your compliance runs on Vanta, its directory is the obvious place to look for Vanta penetration testing providers. This page adds what the directory does not tell you.

What a listing means. The platform has onboarded the firm and knows its reports fit the evidence workflow. It does not rank the firms or vouch for the depth of the testing. That is what this page is for.

What a listing does not mean. Nothing in SOC 2 requires your tester to be a partner of your compliance platform. The auditor evaluates the report, the scope and the dates, not the directory. Any qualified, independent tester works.

How the evidence gets in. Each platform tracks the penetration test as a piece of evidence. You upload the report, and the retest report or attestation letter where the platform asks for proof that findings were fixed. Our reports and attestation letters upload into Vanta, Drata and Secureframe like any other evidence file.

What to check whichever route you take. The same five things the auditor checks: scope, dates, methodology, remediation status and the attestation letter. A partner badge does not change any of them.

The best SOC 2 penetration testing providers in 2026

1. Invadel

Best for: a fixed-price test with the report and attestation letter written for the SOC 2 auditor.

Every Invadel report carries a SOC 2 mapping section that ties each finding to the Trust Services Criteria it affects, plus the attestation letter above. Testing is manual, performed by a senior in-house team, scheduled to land inside your audit period, and the retest of remediated findings is included at no charge, so the evidence set arrives complete. Prices are published: web application tests from $5,200, external network from $4,200, with the full list on the pricing page and the framework detail on our SOC 2 penetration testing page. The honest limitation: we do not perform the SOC 2 audit itself. The assessors who do are on our cybersecurity audit companies list.

2. A-LIGN

Best for: buying the penetration test and the SOC 2 audit from one firm.

A-LIGN is a licensed CPA firm that performs SOC 2 attestations and also offers penetration testing through a separate practice, with the independence separation the standard requires. One vendor relationship, two teams.

3. Rhymetec

Best for: startups pairing penetration testing with vCISO and compliance services.

A compliance-focused security firm serving startups and growth-stage SaaS companies, offering penetration testing alongside virtual CISO and SOC 2 readiness work, and a frequent name in the compliance platforms’ partner directories.

4. Cobalt

Best for: PTaaS with a fast start, integrated with compliance platforms.

A penetration-testing-as-a-service platform with a tester network, integrations with compliance automation tools, and a portal for findings and retests. Quick to schedule; depth depends on who is assigned. See Invadel vs Cobalt.

5. Software Secured

Best for: SaaS companies that want a developer-friendly testing relationship.

A boutique focused on application security for software companies, with SOC 2 among the compliance drivers it serves. See Invadel vs Software Secured.

6. BreachLock

Best for: platform-driven testing with continuous retesting through a portal.

A PTaaS provider combining automation and human validation, with compliance-mapped reporting. See Invadel vs BreachLock.

7. Vumetric

Best for: compliance-driven testing from a US and Canadian firm inside a large telecom group.

As of Sep 2026, vumetric.com says the firm is now part of the TELUS family, with headquarters in Las Vegas and Toronto. It states that all testing is done in-house with no outsourcing, runs its own PTaaS platform, and cites ISO 9001 certified processes. Projects are quoted, including through a self-service quote tool, and the site states no retest policy, so ask about it before you sign. See Invadel vs Vumetric.

8. Raxis

Best for: US companies that want a traditional manual test with a straightforward report.

A US penetration testing firm offering manual testing and a PTaaS option, with SOC 2 among the frameworks it reports against. As of Sep 2026, raxis.com says retesting is included with its Raxis Strike and Raxis Attack services: you request it through the Raxis One platform, and the engineers who found the issue check the fix. See Invadel vs Raxis.

9. Packetlabs

Best for: manual-first testing with detailed reporting.

A manual-first Canadian firm whose reports are built for compliance audiences. See Invadel vs Packetlabs.

10. Astra Security

Best for: companies that want a scanning platform with a pentest option and compliance dashboards.

A vulnerability scanning platform with penetration testing services layered on top and compliance views inside the product. See Invadel vs Astra Security.

How to buy this without a surprise

• Book the test for the middle of the audit period, not the end. Remediation and retest take weeks; the evidence has to be complete before fieldwork.
• Ask whether the retest is included. A test with a critical finding and no retest is an open finding in the SOC 2 report.
• Ask to see the attestation letter format. If the vendor does not know what that is, the auditor will be writing you follow-up questions.
• Fix the price before the scoping call. SOC 2 tests are the most commoditized purchase in security and still routinely arrive as day-rate estimates. Our fixed prices are on the pricing page.
• Get the sample report. Ours is on the sample report page.

Frequently asked questions

Do we have to use a Vanta partner for our SOC 2 penetration test? No. SOC 2 does not require the tester to be listed in your compliance platform’s directory, and the auditor judges the report, not the listing. Any qualified, independent tester works, as long as the scope matches your system description, the dates fall inside the audit period, and remediated findings are retested. The same answer holds for Drata and Secureframe.

Does SOC 2 require a penetration test? No. Penetration testing appears only as an example of a separate evaluation in the CC4.1 points of focus. The criteria require vulnerability identification and monitoring, and auditors treat a penetration test as the standard evidence. See SOC 2 penetration test requirements.

How often? At least annually, inside each audit period, and after significant changes to the in-scope system. See how often you should do a penetration test.

Can a vulnerability scan replace it? Most auditors will accept a scan as part of the evidence and still ask where the penetration test is. See penetration testing vs vulnerability scanning.

Can the same firm do the test and the audit? Some firms offer both through separate teams. Many companies use two vendors so nobody grades their own homework.

Should we outsource the test or build a team? For an annual SOC 2 test, most companies outsource penetration testing; one senior hire costs more than several fixed-price tests. Our guide on how to outsource penetration testing covers when each makes sense.

Will investors or an acquirer ask for the same report? Often, yes. A buyer’s or investor’s security review asks for the latest test and proof the findings were fixed. See cybersecurity due diligence for what a deal review looks at.

The short version

Choose a provider whose report is written for the auditor, whose retest is included, and whose price is known before the call. If SOC 2 is not your only driver, our lists of the best penetration testing companies and web application penetration testing companies cover the wider market. If a fixed price and a free retest are what you want, scope a SOC 2 penetration test.