SOC 2 Penetration Testing in Australia: Requirements, Type 1 vs Type 2, Scope and Cost

SOC 2 doesn't make penetration testing mandatory, but most Australian SaaS and service businesses going through a SOC 2 audit end up needing one. The AICPA's Trust Services Criteria list penetration testing as an example of the evaluations management uses under CC4.1, and CC7.1 expects you to find and fix vulnerabilities. Once your system description commits to an annual pentest, your auditor will test that commitment. At Aussie Pentest, human-led penetration testing starts from $5,000 + GST, and every report maps findings to SOC 2 control themes.

This guide covers what SOC 2 actually says about testing, how Type 1 and Type 2 change what you need, what to scope, how often to test, what it costs in Australia and how it overlaps with ISO 27001, Essential Eight and the Privacy Act. For the other half of the usual SaaS compliance pair, see ISO 27001 penetration testing.

What is SOC 2, and why do Australian businesses need it?

SOC 2 is an independent attestation report on a service organisation's controls, built on the AICPA's Trust Services Criteria. It isn't a certificate and it isn't an Australian law. Australian SaaS companies, managed service providers and data processors usually pursue it because US and enterprise customers ask for it in vendor due diligence.

A SOC 2 report covers one or more of five trust services categories:

• ▸Security (the common criteria, CC1 to CC9), which every SOC 2 report includes
• ▸Availability: uptime and resilience commitments
• ▸Processing integrity: complete, accurate and timely processing
• ▸Confidentiality: protection of information designated as confidential
• ▸Privacy: collection, use and disposal of personal information

The AICPA sets the standards for SOC engagements, and CPA firms issue the reports. Australian assurance practitioners can also report on controls under the AUASB's ASAE 3150 Assurance Engagements on Controls, so confirm which report your customer will accept before engaging an auditor.

In our experience the trigger is almost always a customer questionnaire that asks for your SOC 2 report and, a line later, your latest penetration test summary. Buyers want proof that controls exist and proof that someone tried to break them.

Does SOC 2 require penetration testing?

No SOC 2 criterion says "you must perform a penetration test", but the criteria and your auditor's expectations point strongly towards one. The requirement usually comes from your own control set: if your system description says an independent pentest happens annually, that becomes a control the auditor tests.

The criteria that point to testing

• ▸CC4.1 (monitoring activities): the entity performs ongoing and separate evaluations to check that controls are present and functioning. The point of focus explicitly lists penetration testing, independent certification against established specifications (for example ISO certifications) and internal audit assessments as types of evaluation management may use. See the AICPA's 2017 Trust Services Criteria (revised points of focus, 2022).
• ▸CC7.1 (system operations): the entity uses detection and monitoring procedures to identify configuration changes that introduce vulnerabilities and susceptibility to newly discovered vulnerabilities. Its point of focus calls for infrastructure and software vulnerability scans periodically and after significant changes, with timely remediation.
• ▸CC8.1 (change management): changes are authorised, tested and approved before implementation, which security testing before major releases supports.

Why "not mandatory" is the wrong takeaway

Points of focus are examples, not a checklist: the AICPA notes that using the criteria doesn't require assessing whether each one is addressed. That flexibility cuts both ways. You choose your controls, then have to show they work. For an internet-facing SaaS platform, it's hard to argue that scanning alone proves your access controls, tenant isolation and authentication hold up. Most auditors, and most enterprise customers reading your report, expect a recent independent penetration test.

What's the difference between SOC 2 Type 1 and Type 2 for pentesting?

A Type 1 report assesses control design at a single point in time; a Type 2 report assesses whether controls operated effectively across a review period. That difference changes when you test and what evidence you need.

Timing your test in a Type 2 window

A pentest finished before a Type 2 period starts usually doesn't evidence that period. Book testing early in the window so findings can be fixed and retested before it closes. A test in the final fortnight leaves little time to remediate and verify, and unverified fixes are where exceptions tend to appear.

What does a SOC 2 auditor look for in a pentest?

Auditors want evidence that testing matched your system description, was performed by competent and independent people, and fed into remediation. The report itself is only the starting point.

Typical evidence requests include:

1. Scope: which systems were tested and how that maps to the system boundary in your SOC 2 description
2. Tester independence and competence: who performed the test and their relationship to the people who built and run the system
3. Rules of engagement: written authorisation, testing windows and any production safeguards
4. The report: dated, with severity-ranked findings, evidence and remediation guidance
5. Ticketing and tracking: findings logged with owners and target dates in line with your vulnerability management SLAs
6. Remediation proof: retest results showing fixes hold, or documented risk acceptance
7. Management review: evidence that results were reported to leadership, which supports CC4.2 (communicating deficiencies)

A warning about "quick-turn" compliance

The AICPA has publicly flagged concerns about quick-turn SOC engagements and unlicensed practitioners, and urges service organisations to evaluate SOC providers thoroughly. The same applies to testing. An unreviewed scanner export sold as a "pentest" might tick a box in a compliance platform, but an experienced auditor or enterprise security team will notice. Ask any provider who is on the keyboard, how much is manual, and whether they'll show you a sample report.

What should a SOC 2 penetration test cover?

Scope should follow your SOC 2 system boundary: the application, its APIs, the cloud environment it runs in and the identity layer that controls access. Testing systems outside the boundary adds cost without adding audit evidence.

Common scope areas for Australian SaaS companies

• ▸Web application: authentication, session management, access control between roles and tenants, business logic and the OWASP Top 10 categories. See web application penetration testing.
• ▸APIs: object-level authorisation, rate limiting, token handling and data exposure. See API penetration testing.
• ▸Cloud environment: AWS, Azure or GCP misconfiguration, over-privileged identities, exposed storage and secrets. See cloud penetration testing.
• ▸External network: internet-facing hosts, admin interfaces, VPNs and remote access
• ▸Corporate identity: Microsoft 365 or Google Workspace, SSO and MFA configuration where staff access production

Multi-tenancy is where SOC 2 tests earn their keep

The question every SaaS buyer cares about is whether one customer can see another customer's data. Scanners can't answer it because they don't understand your tenancy model. A grey-box test with accounts in two tenants can. Broken access control is ranked first in the OWASP Top 10:2025, and OWASP reports that every application in its tested data had some form of it. The classic version is simple: change an ID in a request and get someone else's record. You want to find that before your SOC 2 period, not in a customer's own testing.

If your product includes AI features or was built quickly with AI coding tools, include those flows too. Our guide on pentesting AI applications before launch covers what changes.

How often should you pentest for SOC 2?

At least once a year for in-scope systems, and after significant changes, unless your risk assessment justifies something different. SOC 2 doesn't set a frequency. You set one in your policy and system description, and the auditor tests you against it.

Practical triggers for an additional test:

• ▸A major release, new authentication flow or new public API
• ▸Moving to a new cloud provider, region or account structure
• ▸Adding a new trust services category, such as privacy, to your report
• ▸A security incident or near miss affecting in-scope systems

Between tests, continuous scanning supports CC7.1. Our automated security assessment ($80 to $2,000 AUD, analyst-reviewed, 24 to 72 hour SLA) is a useful between-test check, but it is not a penetration test and we don't sell it as one. See vulnerability assessment vs penetration testing and how often you should get a penetration test.

How much does SOC 2 penetration testing cost in Australia?

At Aussie Pentest, fixed-fee human-led engagements start from $5,000 + GST, and most SaaS SOC 2 scopes land in the Standard or Advanced tiers. Price depends on the number of applications, user roles, APIs and cloud environments inside your system boundary.

Engagements are typically delivered in 5 to 10 business days. Every report includes an executive summary, CVSS-scored findings, proof-of-concept evidence on every critical, plain-English remediation, mapping to ISO 27001, Essential Eight and SOC 2, and retest confirmation that each fix holds. International clients are GST-free. Full details are on the pricing page.

What drives the price up or down

• ▸User roles and tenants: each role and tenant boundary multiplies access-control testing
• ▸API surface: documented APIs with an OpenAPI spec are faster to test than undocumented ones
• ▸Cloud complexity: multiple accounts, subscriptions or projects add effort

Not sure where your system boundary lands? Book a 1-on-1 scoping call and we'll give you a fixed-fee quote before anything starts.

How does SOC 2 testing overlap with ISO 27001, Essential Eight and the Privacy Act?

One well-scoped pentest can support several frameworks, provided the scope covers what each one examines and the report maps findings to each. Australian SaaS companies selling locally and overseas often face three or four at once.

ISO 27001

ISO 27001 Annex A controls 8.8 and 8.29 play a similar role to CC4.1 and CC7.1. If your ISMS scope and SOC 2 boundary cover the same platform, one engagement can serve both audits. More in ISO 27001 penetration testing.

Essential Eight

ASD's Essential Eight is a technical maturity model for baseline controls such as patching, MFA, application control and backups. Australian government and enterprise buyers often ask about it alongside SOC 2. A pentest tests attack paths; an Essential Eight assessment ($4,950 + GST for up to 50 seats) measures maturity across all eight controls.

Privacy Act and the NDB scheme

Under Australian Privacy Principle 11, organisations covered by the Privacy Act must take reasonable steps to protect personal information. SOC 2 doesn't replace that obligation, but pentest evidence helps show what reasonable steps looked like. See our guide to Privacy Act cyber security requirements.

Why does this matter for Australian businesses right now?

Because buyers are asking for evidence, and breach volumes keep rising. A SOC 2 report with a weak or stale pentest behind it invites follow-up questions in enterprise deals.

Verified Australian context:

• ▸The OAIC received 1,205 data breach notifications in calendar year 2025, the highest since the Notifiable Data Breaches scheme began in 2018 and 8% more than in 2024. Malicious or criminal attacks caused 716 of them.
• ▸ASD's Annual Cyber Threat Report 2024–25 recorded over 84,700 cybercrime reports, on average one every six minutes. The average self-reported cost of cybercrime per report was $56,600 for small businesses and $97,200 for medium businesses.

How do you prepare for a SOC 2 penetration test?

Line up scope, accounts and remediation time before testing starts, so the report lands early enough in your audit window to fix and retest.

1. Confirm your system boundary with your auditor and pick the components that carry the most customer risk
2. Book testing early in the Type 2 period, or six to eight weeks before a Type 1 date
3. Create test accounts for each role, in at least two tenants, plus API documentation if you have it
4. Agree rules of engagement: testing windows, out-of-bounds systems and emergency contacts
5. Tell your MSP or hosting provider so alerts aren't treated as a real incident
6. Reserve engineering time and log every finding with owners and dates that match your vulnerability SLAs

Our preparation checklist goes deeper, and what a penetration testing report includes shows what you'll receive.

If you want ongoing help between audits, including the risk register, board reporting and testing cadence, a vCISO retainer runs from $2,500 to $6,500 a month. It's advisory and oversight, not implementation and not incident response. MSPs supporting clients through SOC 2 can also resell testing under their own brand through our white-label program.

Frequently asked questions

Can a compliance automation platform replace a SOC 2 pentest?

No. Compliance platforms are useful for collecting evidence and running continuous checks, and many integrate scanners. They don't perform manual testing of your access controls, tenant isolation or business logic. Most will simply ask you to upload a third-party pentest report.

Does the pentest have to be done by an independent third party?

The criteria don't name a provider type, but CC4.1 values objective evaluation, and customers reading your report give more weight to independent testing. Internal testing by the team that built the platform is hard to present as objective.

Will our SOC 2 report show the pentest findings?

Usually not in detail. A Type 2 report describes the control, the auditor's tests and any exceptions. Customers often request the pentest summary separately under NDA, so a clean executive summary matters.

Do we need to fix every finding before the audit?

No, but you need to treat findings according to your policy. Fix, mitigate or formally accept each one with a documented reason. Untreated critical or high findings, or findings left past your own SLA, are likely to draw auditor attention.

Bottom line

SOC 2 won't say "do a penetration test", but CC4.1, CC7.1, your own system description and every enterprise customer reading your report lead to the same place. Scope the test to your system boundary, focus on access control and tenant isolation, run it early in your audit window, track every finding and verify the fixes. Done properly, one engagement supports SOC 2, ISO 27001, Essential Eight and Privacy Act obligations together. Aussie Pentest engagements start from $5,000 + GST, with fixed fees, written scope, SOC 2 mapping and retest confirmation in every report.

Ready to scope your test? Book a 1-on-1 call, or review our penetration testing services and pricing.

Sources

• ▸Aussie Pentest: Penetration Testing
• ▸Aussie Pentest: Pricing
• ▸AICPA & CIMA: SOC 2, SOC for Service Organizations: Trust Services Criteria
• ▸AICPA: 2017 Trust Services Criteria (revised points of focus, 2022)
• ▸AUASB: ASAE 3150 Assurance Engagements on Controls
• ▸OWASP Top 10:2025, A01 Broken Access Control
• ▸OAIC: Data breach notifications increase to all-time high in 2025
• ▸OAIC: APP Guidelines Chapter 11, Security of personal information
• ▸ASD: Annual Cyber Threat Report 2024–25
• ▸ASD: Essential Eight maturity model

This article is general information only, not legal, audit or compliance advice. Aussie Pentest is not a CPA firm and does not issue SOC 2 reports; a penetration test supports your SOC 2 evidence but doesn't guarantee an audit outcome. Prices are current as of October 2026, and statistics and standards references were checked in October 2026. Confirm your requirements with your service auditor or a qualified adviser, and only test systems you have written authority to assess.