Solution
Compliance Penetration Testing
A scoped penetration test of your web apps, APIs, cloud or network, with a report written for auditors and enterprise buyers. AI agents cover the breadth; our engineers exploit and chain the findings that matter. Our team holds OSCP and CISSP certifications.
For: Teams that need a pentest for SOC 2, ISO 27001, PCI DSS or an enterprise customer.
Not ready for a call? Run a free scan with DSO ↗ Free plan, no card: SAST, SCA with reachability, IaC and secret scanning, unlimited seats and repositories.
Every engagement is quoted after a scoping call, based on what we would actually test. How engagements are priced
What's included
- Scoping call and rules of engagement
- Agentic recon and testing, then manual exploitation by our engineers
- Proof of concept and fix guidance for every finding
- Technical report and executive summary
- Retest of the findings you fix
Who is a compliance pentest for?
A compliance pentest is for companies that need independent proof that their systems were tested. The trigger is usually an audit or a buyer: a SOC 2 or ISO 27001 audit, PCI DSS requirements, or an enterprise customer's security review that asks for a recent pentest report.
The report has two readers. Your auditor or customer gets an executive summary they can file, and your engineers get the technical detail they need to fix each finding.
How does the engagement run?
It runs in 6 steps, each agreed with you before it starts.
- 01
Scoping call
We agree what is in scope (applications, APIs, cloud accounts or network ranges), which environment we test, and which framework or customer request the report has to answer.
- 02
Rules of engagement
Before testing starts, we put in writing what may be tested, from where, during which hours, and who to call if something looks wrong.
- 03
Agentic recon and testing
AI agents map the attack surface and run broad tests across everything in scope, so our engineers start from the whole picture.
- 04
Manual exploitation
Our engineers confirm what the agents found, exploit it and chain findings together to show the real impact. A serious issue is reported to you as soon as it is confirmed, not held back for the report.
- 05
Report
You receive the technical report and the executive summary. Every finding comes with a proof of concept and fix guidance.
- 06
Retest
Once your team has fixed the findings, we test them again and update the report to show what is resolved.
What do you receive?
- Technical report with a proof of concept, impact and fix guidance for every finding
- Executive summary written for auditors, customers and leadership
- Retest of the findings you fix, with an updated report
What do we need from you?
- A named contact who can make decisions while testing runs
- The list of targets and the environment we should test
- Test accounts for each user role in scope
- Written authorisation from the owner of each system in scope
- A fast way to reach your team if we find something serious
Questions
Does a pentest make us SOC 2 compliant?
No. A SOC 2 report is an auditor's opinion on your controls, and a pentest is one piece of evidence the auditor can use. It is not required by the criteria, but auditors commonly ask for one.
Do you need a pentest for SOC 2? →Can we share the report with customers?
Yes, the executive summary is written to be shared with auditors and enterprise buyers. The technical report holds exploit detail, so keep it with your engineers.
How is the price set?
Each pentest is quoted after a scoping call, based on what is in scope and how deep the testing goes. You get a firm quote in writing before any work starts.
What drives the cost of a pentest →Other engagements
Book a call
Book a 30-minute call
Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.
Cyphlon
1:1 Consultation Call
30 min
Google Meet
An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.