Pentrail
$20 flatScan free

SOC 2 penetration test · $20 flat

The SOC 2 pentest report, for $20.

Type your domain. We test it the way an attacker would, score every finding with CVSS, map it to SOC 2 and write the report your auditor asks for.

https://

Free scan in 30 secondsFull test and PDF $203 free retests

Scanning

yourcompany.com

    Free scan ·

    Full pentest reportDeep test, every finding with evidence and fix, SOC 2 map, PDF and letter of attestation
    $20

    First you prove the domain is yours with a DNS record or a file. It takes about two minutes. We never deep-test a site without it.

    What the free scan found

    What $20 gets you

    A report your auditor can read in five minutes.

    1. Cover and gradeOne page your CTO, auditor and customers understand.
    2. Executive summaryWhat we found, what to fix first, how long each fix takes.
    3. SOC 2 control mapCC4.1, CC6.1, CC6.6, CC6.7, CC7.1 and more, each with its findings.
    4. Every finding, with proofCVSS v3.1 score, CWE, the real request and response, the fix.
    5. Letter of attestationFor security questionnaires, with a public link anyone can check.
    Open the sample report

    Why it’s $20

    A pentest used to be billed by the hour. Now it’s software.

    Pentest firm1 to 6 weeks
    $5,000 – $30,000
    AI pentest servicesIntruder, Cobalt
    from $3,500
    PentrailMinutes
    $20

    Firm prices: Vanta, Secureframe, Drata, Synack. Platform: Intruder and Cobalt published prices, November 2026. Sources

    Where a pentest’s price goes

    Scoping calls, running the same scanners every firm runs, checking the results by hand, and writing it all up. Those are hours, and hours are what you were billed for.

    Why now

    In 2025 an autonomous AI reached the top of HackerOne’s US leaderboard, and DARPA’s AI Cyber Challenge systems found 54 of 63 planted vulnerabilities. The work that filled a pentester’s week now takes minutes of compute.

    What wins

    When everyone can make a pentest report, the price drops to the cost of the compute. What’s left to compete on is rigor: real evidence, honest scope, fixes that work. That’s the whole product.

    Why a pentest costs $20 now

    Built for SOC 2

    Mapped to the criteria auditors test.

    SOC 2 doesn’t name a pentest as mandatory, but the Trust Services Criteria list penetration testing among the evaluations under CC4.1, and most auditors and enterprise customers ask for one. The report maps every finding to the criterion it touches.

    SOC 2 penetration testing, explained
    • CC4.1Separate evaluationsThe report is your evidence
    • CC6.1Logical access securityExposed files, credentials, open databases
    • CC6.6Threats from outsidePorts, headers, subdomains, CORS
    • CC6.7Data in transitTLS versions, certificates, HSTS
    • CC6.8Malicious softwareScript integrity, CSP
    • CC7.1Vulnerability detectionKnown CVEs, end-of-life software
    • CC8.1Change managementThird-party code, debug in production
    • CC2.3External communicationA security.txt contact

    Only with permission

    We test what you prove is yours.

    Every real pentest starts with authorization. Ours takes two minutes: add one of these, and the deep test runs on that domain only.

    Covers subdomains

    DNS record

    TXT  yourcompany.com
"pentrail-verification=7f3a…"

    A file on the site

    /.well-known/
  pentrail-verification.txt

    A meta tag

    <meta name="pentrail-verification"
      content="7f3a…">

    Tested

    Encryption in transit, security headers, cookies, CORS, known-vulnerable libraries, error pages, 80 exposed paths, 50 ports, subdomain takeover, DNS and email spoofing, zone transfer.

    Not tested

    Anything behind your login, business logic, internal networks, social engineering. If a customer needs those tested by hand, the report shows the tester where to start.

    Never

    No exploitation past proving a weakness, no password guessing, no denial of service, no data changed. How it works

    Questions

    Does SOC 2 require a penetration test?
    Not explicitly. The Trust Services Criteria list penetration testing among the evaluations under CC4.1 and require finding vulnerabilities under CC7.1, and most auditors and enterprise customers ask to see a pentest report. The full answer
    Will my auditor accept it?
    It gives them what they look for: an authorized, dated external test with its scope, method, CVSS-scored findings, evidence and your fixes, plus a retest. Auditors decide what evidence they accept, so if yours requires a manual test of your logged-in app, tell us and use this report to scope it.
    Is it safe to run on my production site?
    Yes. The test is non-destructive: a couple of hundred ordinary requests at a gentle pace, TCP connections to common ports, no exploitation, no password guessing, no load testing. Requests identify themselves as PentrailScanner/1.0.
    What if I can’t verify the domain?
    You verify before you pay, so you’re never charged for a test we can’t run. Send the order link to whoever manages your DNS; it waits for you.
    What does “3 free retests” mean?
    Fix what the report found, press Retest, and the report updates with the new results. Three times within 30 days of buying, included in the $20.
    Is it really $20?
    Yes: one domain, one payment, no subscription, no sales call. Not happy with the report? Write to us within 30 days for a full refund.

    Know your grade in 30 seconds.

    https://