SOC2 and Pentesting Trends 

Penetration testing (pentesting) in the last several years has become increasingly common for not only tech companies, but anyone who handles data, credit cards, has a web application, and/or handles other PII (Personally identifiable information). We wanted to explain the reason behind this trend and other important things you should know about SOC2 and pentesting.

‍

Why the Rise in Pentesting?

Cyberattacks are growing more sophisticated and damaging. It is everyday that we hear about data breaches at companies like Uber, Snowflake, Twilio, etc. Businesses handling and storing data will generally have to get a SOC2 audit. This will show how the companies handle user data; specifically how they will prevent a breach, and then react if a data breach did happen. Pentesting is a test to show you have these preventions in place and if they are susceptible to a malicous hacker. In the past, penetration testing has usually been reserved for large companies but has recently entered the SMB space.

SOC 2 and Pentesting

SOC 2 isn't just about policies and documents. It requires proof in the form of what are called "controls" to show that your security measures work in practice. Pentesting provides tangible evidence and a list of vulnerabilities to patch. It uncovers holes in your initial risk assessment, and a post-remediation test validates the patches made. The cost associated with a penetration test will depend on the size of the test. 

A SOC2 Web Application Test will cost you between $2,500 to $20,000+

‍

K1C offers $3,000 web app tests for up to 5 pages!

Not All Pentests are the Same: Automated vs Manual Pentesting

SOC 2 Pentesting requirements are not clear. The rise of automated penetration testing has become a check-the-box solution that is frequently seen in companies that are tight on budget. Automated pentests are at best a deep vulnerability scan; unless findings are tested and verified by an actual penetration tester. CPAs are certified accountants and not cybersecurity experts leaving this control to be awfully confusing and frequently debated.

It is best practice for companies to get manual penetration testing.

If you need help figuring out what kind of pentest you need, come chat with us!

‍