SOC 2 / PENETRATION TESTING AS A SERVICE
SOC 2 readiness.
Expert testing.
Evidence to act on.
Connect your penetration test to the work behind SOC 2. Hackrate PTaaS brings selected ethical hackers, validated findings, remediation tracking, and retesting into a scoped assessment your engineers and reviewers can use.
A scoped assessment.
A reviewable response.
- SCOPE
- Approved targets, roles, and test window
- FINDINGS
- Technical evidence and demonstrated impact
- REMEDIATION
- Owners, actions, and outstanding issues
- RETEST
- Verification outcome and limitations
CONNECT TECHNICAL WORK TO ASSURANCE
What does a pentest
contribute to SOC 2?
SOC 2 is an examination of a service organisation’s system and controls against the applicable Trust Services Criteria. Its categories address security, availability, processing integrity, confidentiality, and privacy. Your examination scope determines which criteria and controls are relevant.
A penetration test can provide technical evidence about selected systems and attack paths. The value includes what happens after discovery: how your team assesses findings, assigns ownership, implements changes, and verifies the result. PTaaS keeps that assessment and follow-through connected.
SOC 2 framework: AICPA SOC suite of services and Trust Services Criteria.
HACKRATE SERVICES
Build a testing engagement
around your audit objectives.
Start from the system, risks, and evidence needs. Agree how the assessment will run and how its findings will reach the people responsible for the response.
Testing around your system
Define the applications, APIs, environments, user roles, and business flows relevant to the engagement. Connect the technical scope to your system boundary and the control evidence your team and auditor expect to review.
Prepare the right scopeSelected, verified researchers
Hackrate PTaaS uses selected ethical hackers for an invitation-only assessment. Agree researcher participation, verification requirements, access, confidentiality, and rules of engagement before testing starts.
Explore researcher trustValidated technical findings
Work from reviewed findings with reproduction information, supporting evidence, demonstrated impact, and remediation guidance. Keep severity and assessment limits visible so engineering and reviewers understand what the test established.
See the evidence to retainRemediation and retesting
Track findings through engineering action and agreed retesting. Define the retest window, included scope, and reporting of outcomes so a claimed fix can be distinguished from a verified change.
Follow the testing workflowPTaaS is an invitation-only testing engagement. For targets requiring delivery exclusively by Hackrate’s internal team, explore traditional penetration testing. Choose the delivery model and access rules during scoping.
EXAMPLE EVIDENCE AREAS
Give control discussions
technical substance.
Agree the mapping with your auditor. Testing can contribute to these discussions, with each conclusion limited to the assessment scope and the evidence available.
How are controls evaluated?
Use a defined assessment to examine selected security controls and relevant attack paths.
Useful evidence
Assessment objectives, methodology, approved scope, test dates, findings, and limitations.
How are weaknesses assessed?
Connect technical findings to impact, priority, and the team responsible for action.
Useful evidence
Reproduction steps, supporting evidence, severity rationale, affected assets, and open questions.
How are findings followed through?
Make remediation ownership and progress visible, including items requiring further work.
Useful evidence
Assigned owners, decisions, mitigation or fix records, outstanding issues, and management review.
What changed after the fix?
Use agreed retesting to verify the relevant behaviour after remediation.
Useful evidence
Retest scope, dates, outcome, remaining limitations, and links to the original finding.
These are examples of Hackrate deliverables to discuss against your applicable controls. Your CPA firm determines the examination procedures and evaluates the evidence.
PLAN AROUND THE EXAMINATION
Type 1 and Type 2.
Different evidence timelines.
Bring the relevant date or period into the scoping conversation. Leave room for technical assessment, engineering work, and verification before evidence is needed.
SOC 2 Type 1
Addresses the system description and suitability of control design as of a date. Align the assessment and any corrective work with the controls and evidence relevant to that examination.
SOC 2 Type 2
Also addresses control operating effectiveness over a period. Agree how testing, remediation, retesting, and retained records fit the operation of your controls during that period.
Report types: AICPA SOC 2 guide, introduction and background.
Choose frequency and coverage with your auditor.
A test schedule should reflect your risks, control commitments, system changes, and evidence needs. A single assessment provides bounded technical evidence; your wider programme needs to demonstrate the controls relevant to the examination.
FROM SCOPE TO VERIFIED ACTION
Test. Remediate.
Retest. Review.
Build the engineering response into the engagement plan. A clear finding, an accountable owner, and a recorded outcome are more useful together.
Align scope and timing
Bring your system description, audit dates, assessment objectives, and relevant controls. Agree targets, access, environments, reporting format, and the time available for fixes and retesting.
Test and validate
Selected ethical hackers assess approved targets under the rules of engagement. Hackrate reviews findings and technical evidence, requests clarification, and connects validated issues to your team.
Remediate and record
Your engineers investigate and implement fixes or mitigations. Record ownership, decisions, relevant changes, and outstanding risks. Keep the response connected to the original finding.
Retest and review
Run the agreed verification against remediated findings. Record the result and limitations, keep remaining issues visible, and provide the agreed assessment evidence for management and auditor review.
MAKE THE ASSESSMENT REVIEWABLE
What should the
pentest evidence show?
Agree the reporting format and required records before testing. Keep enough context for engineering, management, and your auditor to understand the assessment and response.
Set report access, evidence handling, retention needs, and included retesting during scoping. Your organisation owns its formal control documentation and the information shared with the CPA firm.
Scope and approach
Approved assets, environments, user roles, assessment dates, methodology, and constraints. Identify what was included and which boundaries affect the conclusions.
Evidence and impact
Validated technical detail, reproduction steps, severity rationale, and remediation guidance. Keep observed impact distinct from assumptions needing investigation.
Ownership and action
Responsible teams, decisions, progress, and the chosen fix or mitigation. Retain visibility of open items and any internal risk decisions.
Retest outcomes
Agreed verification scope, dates, results, and limitations. A resolved status should be supported by the relevant evidence and your handling process.
Lensing connected audit preparation
with crowdsourced testing.
Lensing chose Hackrate’s crowdsourced security testing while preparing for its SOC 2 audit. The story describes the collaboration and how HackGATE supported its testing process.
Read the Lensing case studyMAKE THE FIRST CONVERSATION USEFUL
Bring your system,
timeline, and evidence needs.
Your security, engineering, compliance, and audit contacts can help shape an assessment that fits the actual system and the planned examination.
Prepare the assessment
- Identify the relevant system boundary, targets, roles, and important business flows.
- Share the audit date or period and the evidence expected by your CPA firm.
- Agree testing permissions, accounts, test data, third-party access, and stop conditions.
- Name engineering owners and plan capacity for fixes and retesting.
Agree the deliverables
- Define the testing approach, participating researchers, and rules of engagement.
- Set finding validation, reporting format, and evidence access.
- Confirm included retesting, its window, and how results will be recorded.
- Agree how technical questions and remaining issues reach the responsible owner.
Hackrate provides the agreed security assessment. Your licensed CPA firm performs the SOC 2 examination and issues the SOC 2 report. Your organisation owns its controls, remediation, and broader readiness work.
YOUR QUESTIONS, ANSWERED
SOC 2 penetration
testing FAQs.
Understand the testing service, evidence, timing, and responsibilities.
Discuss your scopeHow does PTaaS support SOC 2 readiness?
Hackrate PTaaS can provide scoped security testing, validated findings, remediation guidance, progress records, and agreed retesting. These can contribute technical evidence to your control evaluations and vulnerability management process. Align the engagement with your system boundary, relevant controls, audit timing, and the evidence your CPA firm needs.
Does SOC 2 require the same annual pentest for every organisation?
SOC 2 uses the applicable Trust Services Criteria and your organisation’s controls and risks. Penetration testing can be one form of control evaluation, but there is no single testing calendar or scope suitable for every examination. Agree frequency, coverage, and evidence expectations with your auditor, taking account of your commitments, risk assessment, and significant changes.
Does Hackrate issue the SOC 2 report?
Hackrate provides security testing and the agreed technical deliverables. The SOC 2 examination and report are the responsibility of your licensed CPA firm. A penetration test report is supporting evidence and does not replace the service auditor’s work, opinion, or assessment of your wider controls.
How does testing differ for SOC 2 Type 1 and Type 2?
A Type 1 report addresses the system description and suitability of control design as of a specified date. Type 2 also addresses operating effectiveness over a specified period. Plan testing, remediation, retesting, and record retention around the relevant date or period with your auditor. A single assessment does not demonstrate that every control operated throughout a Type 2 period.
Who performs the SOC 2 penetration test?
Hackrate PTaaS is an invitation-only assessment using selected ethical hackers. Agree participants, verification requirements, confidentiality, access, and testing permissions for the engagement. If your targets require an assessment delivered exclusively by Hackrate’s internal team, discuss the traditional penetration testing service instead.
Can web applications, APIs, and authenticated roles be included?
Discuss the relevant targets, user roles, business flows, integrations, and environments during scoping. Agree suitable accounts, test data, access restrictions, and third-party permissions. The final coverage depends on the approved engagement; no assessment should imply that every system or possible attack path was tested.
What happens when the test finds vulnerabilities?
Hackrate provides validated findings and remediation guidance within the service scope. Your team assigns owners and makes risk and remediation decisions. Plan time for fixes and the agreed retesting, and retain the outcomes and any remaining limitations. Your auditor determines how the findings and your response affect the examination.
Is a vulnerability scan the same as a penetration test?
The activities provide different evidence. Scanning can identify known weaknesses and configuration issues; human testing can examine how an attacker may use a weakness within an agreed scope. Define both within your wider security programme according to risk and control needs. A scoped penetration test does not replace ongoing monitoring or every other required control activity.
How much time and budget should we plan for?
The engagement depends on target complexity, roles, access, coverage, reporting needs, and retesting. Share the audit date or period and allow time for scoping, testing, engineering action, and verification. Hackrate can quote the agreed scope; your audit costs and the cost of fixing findings are separate planning items.
PRIMARY REFERENCES
Start from the criteria.
Agree the evidence.
Reviewed 25 October 2026
- AICPA: SOC suite of services The SOC reporting framework and resources for service organisations and CPA firms.
- AICPA: Trust Services Criteria Criteria for the applicable trust services categories, with revised points of focus.
- AICPA: SOC 2 examination guide Authoritative guidance for the professionals performing and reporting on SOC 2 examinations.
Define the testing engagement and its evidence contribution with your internal owners and CPA firm. The examples on this page describe technical work that can support that discussion.
CONNECT TESTING TO SECURITY PROGRESS
Scope the test.
Plan the follow-through.
Bring your systems, audit timing, and assessment objectives. Build a PTaaS engagement with clear coverage, useful findings, and a planned route through remediation and retesting.
Plan Your SOC 2 Pentest
Hackrate
Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.
US Patent Applied for HackGATE #63/645,845
Products
From the Blog
-
Hackrate Ranked 1st in Hungary and 22nd Globally at Hack The Box’s Global Cyber Skills Benchmark 2026
May 29 • 13 min read
-
Press release: Hackrate becomes Hungary’s first CVE Numbering Authority
Jan 13 • 5 min read ★
-
Let 2026 be the year bug bounty becomes part of how you build and operate
Jan 05 • 4 min read
Numbering Authority