Pentrail / SOC 2 guide / SOC 2 Type 1 vs Type 2: what changes for pentesting

SOC 2 Type 1 vs Type 2: what changes for pentesting

Same criteria, different question. A Type 1 asks whether your controls are well designed on one date; a Type 2 asks whether they worked for months. Your pentest evidence has to match.

Updated November 3, 2026 · 5 min read

Type 1 and Type 2 SOC 2 reports use the same trust services criteria. What changes is the question your auditor answers, and that changes when you test, how often, and what you need to keep.

The difference

The AICPA’s own description¹:

A type 2 SOC 2 engagement, which includes an opinion on the operating effectiveness of controls, also includes a detailed description of tests of controls performed by the service auditor and the results of those tests. A type 1 SOC 2 engagement addresses the same subject matter as a type 2 SOC 2 engagement; however, a type 1 SOC 2 report does not contain an opinion on the operating effectiveness of controls …

In plain terms, a Type 1 says your controls are designed well on a single date. A Type 2 says they worked throughout a period, which Software Secured says is “usually 6–12 months.”²

KPMG’s UK benchmarking of SOC reports shows why the difference matters: “It is rare to have Type II reports without exceptions. In fact, the first Type II reports typically have a high number of exceptions and may even be qualified.”³ A Type 2 checks whether you did what your policy says, every time.

Pentesting for a Type 1

A Type 1 is a point-in-time look at design, so the auditor wants to see that a testing control exists and has run. Software Secured says that for a Type 1, “auditors typically expect an external network and web application pentest scoped to your production environment, covering the external perimeter, authentication, and access control.”² Others are more relaxed. One Hacker News commenter: “You literally do not need a pen test to pass SOC2 Type 1, for example.”⁴ Your auditor decides, so ask.

A sensible Type 1 package:

A written policy that says how often you test and scan, and who fixes what, by when
One test finished before the report date, with critical and high findings fixed
A scan schedule that’s already running

Pentesting for a Type 2

A Type 2 changes three things.

Timing. Vanta says “the penetration test must be completed before the end of your SOC 2 observation period in order to be included in your control matrix.”⁵ Ask your auditor whether a test from before the period started counts. Plan the test inside the window, early enough to fix and retest.
Frequency. Software Secured: “For Type 2, auditors expect annual testing, and many firms require evidence of remediation in addition to the pentest report itself.”² Scans run throughout. The CC7.1 point of focus describes them “on a periodic basis and after significant changes are made to the environment.”⁶ If you shipped a major change mid-period, expect to be asked what you tested after it.
Follow-through. If your policy says critical findings are fixed within a set number of days, the auditor can compare that against the dates on your tickets.

Retest evidence is the part people forget

A report full of open findings proves you tested. It doesn’t prove you fixed anything. Secureframe describes the usual flow: after remediation, the firm “will once again attempt those known exploits to find out if those fixes are sufficient to prevent future attacks.”⁷ That retest is your evidence of timely remediation under CC7.1 and of tested changes under CC8.1.

Retests aren’t always included. Synack warns that “A $10,000 engagement that charges $3,000 per retest can finish considerably over budget if your team remediates in phases.”⁸ Fixes also take time: Vanta puts typical remediation cycles at 90 to 180 days.⁵

	Type 1	Type 2
Auditor’s question	Are controls designed well on this date?	Did they operate throughout the period?
When to test	Before the report date	Inside the observation period
Scans	A schedule in place	Results across the whole period
Remediation evidence	Helpful	Often expected
Retest	Shows the fix worked	Ties each finding to a closed ticket

A timeline that holds up

Before the Type 1 date: test, fix critical and high findings, retest.
When the Type 2 period starts: keep scanning on schedule and after major releases.
Early in the period: run the annual pentest, so remediation and the retest land well before it ends.
For each issue, keep the finding, ticket, fix and retest together.

Pentrail fits the rhythm a Type 2 creates. At $20 per domain you can run the external test at the start of the period and again after a big release, and each report includes three free retests within 30 days, so the fix evidence sits next to the finding. A point-in-time test covers your environment on the day it runs⁸, which is why cheap repeat runs help. It only covers what an outsider can reach, not testing behind your login, so if your auditor wants that inside the period, schedule a manual test as well.

See your own grade

Scan your domain and see what an attacker sees.

For a Type 1, have one test done and fixed before the report date. For a Type 2, test inside the observation period, scan throughout, and keep a retest for every finding you fix. The retest is what turns a report into evidence that your controls worked.

Questions

Does SOC 2 Type 1 require a penetration test?

No criterion requires one. Many auditors still expect an external and web application test before the Type 1 report date, so ask yours.

Does SOC 2 Type 2 require penetration testing?

Not explicitly, but auditors commonly expect at least one test inside the observation period, plus evidence that findings were fixed.

When should the pentest happen in a Type 2 observation period?

Early enough to fix findings and retest before the period ends. Vanta says the test must be completed before the observation period ends to be included.

Do I need to retest after fixing pentest findings?

It’s the clearest proof that a fix worked, and many auditors look for remediation evidence in a Type 2. Check whether a test includes retests before you buy it.

Sources

AICPA, TSP Section 100 (2017 criteria, March 2020 update), PDF hosted by Arpio, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy: A type 2 SOC 2 engagement, which includes an opinion on the operating effectiveness of controls, also includes a detailed description of tests of controls performed by the service auditor and the results of those tests. A type 1 SOC 2 engagement addresses the same subject matter as a type 2 SOC 2 engagement; however, a type 1 SOC 2 report does not contain an opinion on the operating effectiveness of controls nor a detailed description of tests of controls performed by the service auditor and the results of those tests.
Software Secured (penetration testing firm), SOC 2 Penetration Testing Services: A SOC 2 Type 1 audit assesses the design of your controls at a single point in time. For Type 1, auditors typically expect an external network and web application pentest scoped to your production environment, covering the external perimeter, authentication, and access control. A SOC 2 Type 2 audit assesses whether controls operated effectively over an observation period (usually 6–12 months). For Type 2, auditors expect annual testing, and many firms require evidence of remediation in addition to the pentest report itself.
KPMG UK, Controls Assurance Benchmarking Report 2024, SOC Reporting Benchmarking: Insights for your assurance journey: It is rare to have Type II reports without exceptions. In fact, the first Type II reports typically have a high number of exceptions and may even be qualified.
Hacker News user TameAntelope, in the thread “Tailscale is officially SoC 2 compliant”, Comment on Hacker News: You literally do not need a pen test to pass SOC2 Type 1, for example.
Vanta, Penetration testing 101: Typical remediation cycles can take 90-180 days depending on the availability of your resources. … If your penetration test is for SOC 2 compliance, the penetration test must be completed before the end of your SOC 2 observation period in order to be included in your control matrix.
AICPA 2017 Trust Services Criteria with revised points of focus (2022), as transcribed in the open-source CISO Assistant library, SOC 2 2017 TSC (rev. 2022), point of focus CC7.1: Conducts Vulnerability Scans — The entity conducts infrastructure and software vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after significant changes are made to the environment. Action is taken to remediate identified deficiencies in a timely manner to support the achievement of the entity’s objectives.
Secureframe, Penetration Testing 101: A Guide to Testing Types, Processes, and Costs: The pen testing firm typically provides you with an initial report of their findings and provides you with an opportunity to remediate any discovered issues. After remediation is completed, the firm will once again attempt those known exploits to find out if those fixes are sufficient to prevent future attacks.
Synack (penetration testing firm), How Much Does a Pentest Cost? 2026 Trends and Insights: A $10,000 engagement that charges $3,000 per retest can finish considerably over budget if your team remediates in phases. … A point-in-time test covers your environment on a specific day under a defined scope.