SOC 2 penetration testing: you don't need a pentest firm anymore

Six months ago, penetration testing for our SOC 2 audit cost somewhere between US$5,000 and US$20,000. Today I can get a better test for about US$1,500, run by AI agents, and I don’t have to talk to a single salesperson to get it.

The short answer to the question most founders ask: SOC 2 does not require penetration testing by an outside firm, and neither does ISO 27001. Both want you to test your security, fix what you find, and prove it. Who does the testing is up to you.

That is a big change, and I don’t think many people have noticed it yet. Here is what changed, what it costs, and what the standards actually ask for.

How SOC 2 penetration testing used to work

If you have been through SOC 2 or ISO 27001, you know the routine. I first went through it at Flood, when we got SOC 2.

Your compliance platform or auditor tells you that you need a penetration test. You ask who to use. They give you a short list of firms you have never heard of. There is usually a middleman taking a cut somewhere along the way. You get a quote for somewhere between US$5k and US$20k, depending on how many “applications” and “IP addresses” they decide you have.

Then you wait. Some weeks later, you get a PDF.

The PDF is about 30 pages long. Most of it is screenshots from automated scanners. The rest is explanation that is either badly written or copied and pasted from a vulnerability database. A missing security header gets a full page. A TLS cipher nobody has used in years gets a “medium” rating. Behind all of it, as far as I can tell, is someone at an outsourcing shop running the same scripts against every client and pasting the output into a template.

It is bullshit. It ticks a box for the auditor. It gives your engineering team almost nothing they can act on.

The worst part is that it happens once a year. Your code changes every day. A test from last March tells you very little about the code you shipped last week.

What AI penetration testing looks like now

AI agents got good at this work. Not “fancy scanner” good. Actually good.

Two tools changed how I think about it: deepsec for the code, and AWS Security Agent for the running app.

Deepsec: find vulnerabilities in your code

Deepsec is an open-source tool from Vercel. It runs over your repository and flags code that looks risky. Then it sends coding agents (Claude or Codex) to look at each flagged file properly, the way a security engineer would. It filters out false positives and tells you who on your team is best placed to fix each problem. You can run it locally or in CI. It finds, and helps you remove, a very large class of problems before anyone outside ever sees them.

Two tips to get the most out of it:

• Use the best model, at its highest effort level. Vercel publishes DeepsecBench, which compares models on 231 real vulnerabilities. When it came out in July 2026, the leader was GPT-5.6 Sol at xhigh effort. It found about 45% more issues than the same model at medium effort, and 96% of what it reported was real. That run cost about US$56 for 50 files. Check the leaderboard before you start, because the leader changes.
• Run it 3 times. Agents don’t find the same things every time. Even the best model finds only about a third of the known issues in a single run. Run it 3 times and combine the results. That catches much more than one run does, and it still costs far less than a day of a consultant’s time.

AWS Security Agent: pentest your running app

AWS launched Continuum in June 2026 as a continuous security service. It finds, ranks, checks and fixes security risks. The penetration testing part, previously sold as AWS Security Agent, uses agents to attack your running application the way a real attacker would. They chain findings together, try exploits, and confirm what actually works.

It also produces a report that looks like it came from a serious security firm. Here is the cover page and table of contents from one of ours:

That test ran on 6 November 2026. The report is 76 pages long, with 6 findings: 2 high and 4 medium. I have blurred the finding titles, because some of them are still open.

What matters is what is inside. Each finding starts with “What this is” and “Why it matters”, in plain English. Then it gives the exact steps to reproduce it, with tokens and secrets already redacted. Every finding in the report has high confidence, which AWS defines as confirmed by actually exploiting it. There is not a single screenshot of a missing security header.

This is the document you hand to your auditor. It also gives your engineers something they can fix the same day.

In my experience, these agents do a better job than any manual pentester we have paid for. The findings are specific. Each one comes with proof that it is real. You can retest a fix straight away, instead of waiting for next year’s engagement.

How much does a SOC 2 penetration test cost?

With a traditional firm, expect US$5,000 to US$20,000 per test. With AWS Security Agent, a full test of a SaaS app costs about US$1,500.

AWS charges US$50 per task-hour for penetration testing. A task-hour is one hour of agent work. Agents work in parallel, so a test that runs for an afternoon can use 20 or 30 task-hours.

That means about US$1,500 buys 30 task-hours of pentesting. AWS’s own example of a full pre-release test of an enterprise SaaS app comes to about US$1,560. New AWS customers also get two months free, with up to 400 task-hours each month.

Compare that with US$5k to US$20k for a PDF of scanner screenshots. It is crazy cheap for what it does.

Because it is cheap, you can stop treating pentesting as a yearly event. Run it before a big release. Run it after you change your auth. Run it every month if you like.

Does SOC 2 require penetration testing?

Not by name, and not from an outside firm. This is the part most people miss.

The SOC 2 Trust Services Criteria mention penetration testing once. It is in a “point of focus” under CC4.1, which is about how you monitor your controls. It is listed as one example of an evaluation you might use, next to things like independent certifications. Points of focus are guidance. They are not a list of requirements.

Many auditors do expect to see some kind of security testing, especially for a Type II report. But nothing says that testing has to be bought from a third-party firm.

Does ISO 27001 require penetration testing?

ISO 27001 doesn’t name penetration testing as a requirement either. The 2022 version asks you to manage technical vulnerabilities (Annex A 8.8) and to test security during development and acceptance (Annex A 8.29). It asks you to do this in a way that fits your risks, and to keep evidence that you did it. It does not name a type of vendor, and it does not say the work must come from outside your company.

What both standards care about is simple. Do you test? Do you fix what you find? Can you prove it? You can do that work yourself. Or you can use a nearly free service like AWS Security Agent, and keep its reports and retest results as your evidence.

Before your audit, talk to your auditor. Tell them what you plan to use and show them a sample report. In my experience, an auditor is much happier with continuous testing and a clear record of fixes than with a once-a-year PDF.

What I would do now

If you are working toward SOC 2 or ISO 27001 today, this is what I would do:

1. Scan your code first. Run deepsec over your repository 3 times, with the top model from DeepsecBench at its highest effort level. Fix what it finds. This is the cheapest work you will ever do on security.
2. Pentest your running app with agents. Point AWS Security Agent at a staging copy of your app. Expect to spend a few hundred to a couple of thousand dollars.
3. Fix, then retest. Close the findings and run the retests. That record of “found, fixed, proven fixed” is the evidence your auditor wants.
4. Keep doing it. Put it on a schedule or tie it to big releases. Security testing should follow your code, not the calendar.
5. Only hire a firm if you have a reason. Some customers will still ask for a named third-party test in their contract. That is fine. Buy one then, for that customer. Don’t buy one by default because someone selling compliance software told you to.

The old pentest industry was selling a checkbox. Now you can get the checkbox and a real security improvement, for less than the old price of the checkbox.

Common questions

Can I run my own penetration test for SOC 2? Yes. Neither SOC 2 nor ISO 27001 says the test must come from an outside firm. What your auditor needs is evidence: what was tested, what was found, and proof that you fixed it.

Will my auditor accept an AI penetration test? Ask them before the audit, and show them a sample report. The AWS Security Agent report has an executive summary, scope, methodology and reproduction steps for every finding, which is what an auditor looks for.

How much does AI penetration testing cost? AWS Security Agent costs US$50 per task-hour. A full test of a SaaS app is about 30 task-hours, or about US$1,500. Deepsec is free and open source. You pay only for the model, about US$56 for 50 files with the top model in Vercel’s July 2026 benchmark.

When do I still need a pentest firm? When a customer contract names one. Some enterprise customers ask for a third-party test by name. Buy it for them when they ask, not by default.