Bug Circuit

For SOC 2 Type I and Type II

SOC 2 penetration testing for startups.

Your auditor and your enterprise customers will ask for a penetration test report. A human engineer tests your SaaS web app and API, and you get a report you can hand over, at a fixed price with no scoping calls.

By the Bug Circuit security team · Last updated

Do you need a pentest for SOC 2, and what does it cost? SOC 2 does not name a penetration test, but most auditors expect one. Bug Circuit tests your web app and API by hand and delivers a written report (executive summary, methodology, every finding with its severity, evidence and fix, and a remediation roadmap) in about 5 business days. It costs $49 one-time, or $147 every 3 months if you also want us to fix the high and critical issues and re-test them, which gives your auditor proof they are closed.

What auditors look for in a pentest report

  • An independent tester: someone outside your team, named in the report.
  • A clear scope and dates: which app, which environment, and when it was tested.
  • The method: how the test was done, not just a list of scanner output.
  • Findings with evidence: each issue rated by severity, with proof and steps to fix it.
  • What you did about it: fixes made and, ideally, a re-test showing the serious issues are closed.

Our report covers every point. See a full example in the sample report before you buy, and send it to your auditor if you want their view first.

What we test in your SaaS

  • Access between customers: can one tenant read or change another tenant’s data? The most damaging SaaS bug, and the first thing we try.
  • IDOR: changing an ID in a URL or API call to reach invoices, files or users that are not yours.
  • Roles and permissions: whether a normal user can do admin-only things.
  • Login and sessions: password reset, multi-factor, session expiry and token handling.
  • Your API: every endpoint the app calls, tested directly, not just through the interface.
  • Input handling and logic: injection, cross-site scripting and flaws in your own business rules.
  • Your public attack surface: subdomains, exposed services, TLS and security headers.
Which plan fits your SOC 2 timeline
Circuit: $49 onceSignal: $147 / 3 months
Manual pentest of your web app and APIYesYes
Written report for your auditorYesYes
We fix the high and critical issues with youNo, you fix themYes
Re-test to show issues are closedNoYes, and every 6 months
Weekly outside checks between testsNoYes
Best forA one-off report before the auditType II observation periods and ongoing proof

From order to auditor

  1. 1

    Verify and authorize

    Prove you own the domain and sign the Authorization to Test. Nothing starts before this.

  2. 2

    We test by hand

    A security engineer tests your app and API, production or staging.

  3. 3

    Report in about 5 days

    Or within 24 hours for $15 per site.

  4. 4

    Fix and re-test

    On Signal we fix the high and critical issues with you and re-test them.

  5. 5

    Hand it over

    Give the report to your auditor and to customers who ask.

When to book it

Book the test 60 to 90 days before your audit starts (fieldwork for Type I, or the start of the observation period for Type II). That leaves time to fix what we find and re-test before your auditor looks. The full timeline, and what to do if you are already late, is in our guide on when to get a penetration test before SOC 2.

Frequently asked questions

Does SOC 2 require a penetration test?
Not by name. No SOC 2 criterion says "you must run a penetration test." In practice most auditors expect one as evidence that you find and fix vulnerabilities, and enterprise customers reviewing your SOC 2 report usually ask for it too. Treat it as expected.
Will my auditor accept your report?
Auditors generally look for an independent tester, a clear scope and dates, the method used, findings with severity and evidence, and what was done about them. Our report covers all of that. Every auditor has their own preferences, so send them our sample report before you buy and ask. It costs nothing to check.
How long does it take?
About 5 business days from when you verify your domain, or within 24 hours with the 24-hour report option ($15 per site). Plan the test 60 to 90 days before your audit window so you have time to fix what we find and show it closed.
How much does a SOC 2 penetration test cost?
With Bug Circuit: $49 one-time for a manual test and written report (Circuit), or $147 every 3 months ($588 a year) for Signal, where we also fix the high and critical issues with you and re-test them. Traditional firms often quote several thousand dollars after a scoping call.
What is in scope?
The web application and API your customers use: login and sessions, access control between accounts and tenants, roles and permissions, API endpoints, input handling and business logic, plus your public attack surface. Internal office networks and cloud-account configuration reviews are not part of this test.
Do you test production or staging?
Either. Many startups point us at a staging environment that mirrors production. Both require you to verify you own the domain and sign an Authorization to Test before anything starts.
Is this a SOC 2 audit or a certificate?
No. A SOC 2 report can only come from a licensed CPA firm. We are the penetration tester: our report is evidence of testing that you give to your auditor and to customers. We do not issue compliance certificates.
What if we already failed to get a pentest before fieldwork?
Tell your auditor honestly. With three or more weeks left you can usually still run a real manual test and fix the worst findings in time; with the 24-hour report option the report itself is not the bottleneck.

Keep reading

When to pentest before SOC 2The timeline, and what to do if your auditor already asked.Security audit for startupsThe same manual SaaS testing, for any startup.A customer asked for a pentest reportWhat to send, and how fast you can have one.Sample reportExactly what you and your auditor will receive.Pentesting for SaaS, fintech and health startupsWhat buyers and regulators expect.Penetration testing for cyber insuranceWhat insurers ask and how a test helps.Free tool: security.txt GeneratorBuild a valid RFC 9116 security.txt so researchers know how to report a bug to you.

Start with the free check

See your public attack surface in seconds, then book the manual test when you are ready.

Ready for the full manual audit? See pricing