Guide · SOC 2 & ISO 27001

Penetration testing for SOC 2 & ISO 27001

SOC 2 and ISO 27001 don't certify a report — they certify that you run a defensible security process. Neither names a price or a specific vendor. What they need is evidence you find vulnerabilities and act on them. Here's exactly what the controls ask for, and how an audit-ready automated pentest answers them — 100% self-serve, with no sales call, at roughly a third to a fifth of what incumbent PTaaS charges.

What the controls require

The specific clauses auditors look at

SOC 2 · CC7.1

Detect vulnerabilities and monitor for new ones. Aegis names its exact classes — SQLi, XSS, SSTI, OS command, path traversal, SSRF and XXE (blind via OAST), plus authenticated IDOR/BOLA and function-level (BFLA) authorization via dual identity — rather than hiding behind “OWASP Top 10.”

SOC 2 · CC4.1

Evaluate whether controls are operating. Proof of attacks attempted and held — not just failures — is exactly this.

ISO 27001 · A.8.8

Manage technical vulnerabilities: identify, assess, remediate, verify. A dated, re-tested report demonstrates the full loop.

How Aegis maps to them

An audit-ready report, built to answer the clause

Auditor wantsIn the Aegis report
Defined scope & methodologyOwnership-verified target, documented test suite
Dated findings with severityEvery finding timestamped, CVSS-rated, retained 18 months
Evidence & remediationReproduction steps and a specific fix per finding
Control verificationVerified Controls — attacks attempted and found safe
Independent sign-offA signed Letter of Attestation in every paid report — scope, methodology, dates, and “no critical or high findings” when true. The one-pager your auditor asks for.
Continuous evidenceA live SOC 2 / ISO 27001 posture dashboard mapped from findings, with a Vanta- and Drata-compatible feed — not just a point-in-time PDF
Re-testingFree re-test after you remediate

See the full control mapping in our methodology.

Between audits

Evidence that stays current, not a once-a-year PDF

CC7.1 wants you monitoring for new vulnerabilities, and A.8.8 is a continuous loop — not a single dated file. Aegis keeps the evidence live between engagements.

Live posture dashboard

A SOC 2 / ISO 27001 posture view mapped straight from your findings, so control status is current the day your auditor looks — not last quarter.

Vanta & Drata feed

A compatible feed pushes findings into the GRC platform you already use, so pentest evidence lands in the same place as the rest of your controls.

Signed attestation letter

Proof-of-safe (Verified Controls) plus an independent Letter of Attestation are an enterprise line item at incumbents like NodeZero and Pentera. Here they're automated and included.

The honest caveat

Your auditor decides — and sometimes needs a human

No report is "SOC 2 compliant" on its own; SOC 2 certifies organisations, not documents. Most auditors accept audit-ready automated pentest evidence, but the final call is theirs. And specific mandates — PCI DSS 11.4, some government procurement — require a qualified, independent human tester. We'd rather say that plainly than sell you something that won't clear your audit. Here's exactly when we're the wrong choice.

Minutes, not months

Get an audit-ready pentest for $1,499 USD.

Verify a domain, accept the rules, and Aegis does the rest. Free to start; no sales call.