$ pentest --compliance=soc2

SOC 2 does not strictly mandate a pen test; auditors expect one and a missing pen test is a common qualified-opinion driver.

$ answer --question="What does a SOC 2 pen test cost?"

A pen test scoped for a SOC 2 Type II audit runs $8,000 to $35,000 for a mid-market SaaS in 2026, sourced from vendor-published cost guides. Audit-firm-bundled pen tests (e.g. Schellman, Coalfire) often discount when included in the same SOW as the SOC 2 audit itself.

Last verified June 2026

$ stat --slot=1

$8-35K

Mid-market SaaS band

Vendor cost-guide

$ stat --slot=2

CC4.1

Relevant TSC criterion

Monitoring controls

$ stat --slot=3

Type II

Pen test typically required

Auditor expectation

$ stat --slot=4

Annual

Typical cadence

Auditor expectation

$ drivers --price

Audit scope (Type I vs Type II)
Type II observation-period audits expect a pen test within the period.
TSC coverage
Security TSC at minimum; Availability and Confidentiality add scope.
Bundle with audit firm
Schellman, Coalfire bundle pen test inside the SOC 2 audit SOW.
Asset count
Single SaaS product is cheapest; multi-product expand scope.
Attestation letter included
Required for the auditor's evidence file. Confirm bundled.