Evidence for your CPA
SOC 2 penetration testing
A penetration test of the systems in your SOC 2 scope: web apps, APIs, cloud accounts, and AI features when they are in scope. Hackerbane does not issue the SOC 2 report. A licensed CPA firm does. The quote is fixed after the scope is agreed.
entry found
What can be in scope
- Web applications
- APIs
- Cloud accounts
- AI features in scope
What is a SOC 2 penetration test?
A SOC 2 penetration test is an authorized attack on the systems your examination covers. The report is evidence for the vulnerability-management criteria. A licensed CPA firm still issues the SOC 2 report after its own examination.
The engagement has three parts:
The scope:
the web apps, APIs, cloud accounts, and AI features the examination actually depends on.
The test:
manual exploitation of those systems, with a proof for each finding an attacker could use.
The handoff:
a report your CPA firm can read, and a retest once the fixes are deployed.
What the test covers
The scope lists the systems. AI features are included only when they are part of that scope.
Web applications
Dashboards and admin tools in the examination, including sign-in, sessions, and who can do what.
APIs
The interfaces those applications and partners call, including ones that move data or start a privileged action.
Cloud accounts
Identity, secrets, storage, and the accounts the service runs in.
AI features, if in scope
Model endpoints, tool calls, and the controls around them, when the product under examination includes them.
Who issues the SOC 2 report
Hackerbane does not issue the SOC 2 report. A licensed CPA firm does, after its own examination. This engagement is the penetration test that firm can use as evidence. The quote is fixed after the scope is agreed, before testing starts.
SOC 2 readiness and controlsHow the test runs
Scope first, then manual testing of the systems in the examination, then a report your CPA firm can use.
Scope and rules
We agree the systems, the environments, the test accounts, the windows, and what is out of bounds. AI features are in or out here. The quote is fixed after that scope is agreed.
Testing
Testers attack the web apps, APIs, and cloud accounts in scope, and the AI features if the scope includes them. Each exploitable finding has a proof.
Report
You receive the findings, the paths, and the fix guidance, written so an examiner can use them. This document is not the SOC 2 report.
Retest
After you deploy fixes, we retest the findings and record what holds.
FAQ
What does a SOC 2 penetration test cover?
Web applications, APIs, and cloud accounts that are in the SOC 2 scope, plus AI features when you include them. The written scope is the list. Systems are not added after the quote is fixed.
Does Hackerbane issue the SOC 2 report?
No. Hackerbane does not issue the SOC 2 report. A licensed CPA firm does, after its examination. We deliver the penetration test, with proofs and a retest, for that firm to use as evidence.
When is the quote fixed?
After the scope is agreed, and before testing starts. The scope names the systems, the environments, and whether AI features are included.
Are AI features always tested?
No. AI features are tested when they are in scope: the model endpoint, the tool calls, and the controls around them. If the system under examination has none, they are not added.
Evidence for the examination
Get a penetration test your CPA can use
Tell us which web apps, APIs, cloud accounts, and AI features are in the SOC 2 scope. We reply within two business days. The quote is fixed after the scope is agreed.
Related services
entry found
Penetration testing
The broader test of web, mobile, APIs, cloud, and signing flows, including work outside a SOC 2 examination.
SOC 2 audit and readiness
Readiness, a controls audit, and the evidence pack. A CPA firm still issues the SOC 2 report.