Short answer
A SOC 2 penetration test from Helix costs $3,000 black box or $4,000 gray box for a typical web app or API. You get a report with the scope, methodology, test dates, and severity-rated findings your auditor asks for. Every finding is reproduced by a second agent before you see it, and retests are free and unlimited.
What you get
- Findings you can act on. Each one is a ticket with a severity, the request that proves it, the impact in plain language, and a fix. Anything that cannot be reproduced never reaches your list.
- A report for your auditor. Technical, executive, and compliance-mapped versions, plus an attestation letter you can share with customers who ask for one.
- Free, unlimited retests. Mark a fix ready and the agents attack it again. The report records the retest result.
- A report in about 24 hours, counted from confirmed scope, signed rules of engagement, and test access.
- verified findings
- 67
- critical / high
- 3 / 13
- reproduced by a second agent
- 100%
From the full report of a gray-box test we ran against OWASP Juice Shop, with the proof and a fix for every finding.
What your auditor sees
Auditors do not grade the test itself. They check that it covered the system in your SOC 2 boundary, that it happened when you said it did, and that you acted on what it found. The report is organised around those questions.
We have been through this ourselves: Helix holds a SOC 2 Type II report and ISO 27001 certification, so the report is written by a team that knows what an auditor asks for.
| Auditor question | Where it is answered |
|---|---|
| What was tested? | Scope section listing every verified host, URL, and repository, with exclusions |
| Who authorised it? | Rules of engagement signed in the portal, bound to the exact assets and test window |
| When did it run? | Test window and delivery dates on the cover page |
| How was it tested? | Methodology and coverage, including what was not found |
| What was found? | Findings rated Critical to Info, each with reproducible evidence and the factor that drives its severity |
| Was it fixed? | Remediation status and retest results per finding |
SOC 2 Type 1 and Type 2 timing
A Type 1 report looks at your controls as of one date. Run the test before that date so the report and your remediation plan exist when the auditor looks.
A Type 2 report looks at whether controls worked over an observation period, commonly 3 to 12 months. Run the test early in the window. That leaves time to fix findings and record the retest inside the same period. If your policy says you test annually, book the next one before the anniversary.
Not sure whether you need a pentest at all? Read our SOC 2 penetration testing requirements guide.
Why a vulnerability scan is not enough
Low-cost "pentests" are often an automated scan with a cover page. Auditors and enterprise security reviewers recognise them, and you spend days triaging false positives. A scanner can tell you a header is missing. It cannot tell you that a user in one customer account can read another customer's invoices.
Helix agents test the way an attacker would: they log in as different roles and tenants, swap IDs, replay requests, and chain issues together. Then a separate agent, which did not find the issue, has to reproduce it. If it cannot, the finding stays out of your report.
Which access level fits SOC 2
- Gray box ($4,000) is the usual choice for a SaaS product. You give us test accounts, ideally two per role in two tenants, and the agents test access control, tenant isolation, and business logic.
- Black box ($3,000) tests your public attack surface with no credentials. It suits a marketing site, a public API, or a first test on a tight budget.
- White box (from $7,000) adds your source code, so the agents can trace issues to the line that causes them. It is priced on codebase size.
More detail in black vs gray vs white box testing.
Pricing
| Access | Price | Fits |
|---|---|---|
| Black box | $3,000 USD | Public attack surface of one web app or API |
| Gray box | $4,000 USD | Authenticated, multi-role SaaS testing for SOC 2 |
| White box | From $7,000 USD | Source-assisted testing, priced on codebase size |
Prices cover a typical, well-bounded single web app or API. Larger scopes are priced before testing starts. Retesting is free and unlimited. For comparison, published October 2026 prices include Astra Pentest Expert at $5,999 a year and Software Secured web and API tests from $10,800. See what a penetration test costs for wider market ranges.
From sign-up to report
- Create an account on the Helix PTaaS portal and pick black, gray, or white box.
- Add your scope: the domains, URLs, and repositories in your SOC 2 boundary. Each asset is checked for ownership.
- Sign the rules of engagement and pay by card or invoice. No traffic is sent before the signature exists.
- Get the report about 24 hours after the signature and test access are confirmed, with findings as tickets your engineers can work from.
- Fix and retest as many times as you need. Share the final report and attestation letter with your auditor.
Need a larger scope, a security questionnaire answered, or an invoice for procurement? Talk to us.
Check with your auditor first
Your auditor decides what evidence is sufficient, so a two-minute email before you book saves a surprise later. Copy this and fill in the brackets:
Hi [auditor], We plan a penetration test of [system in our SOC 2 boundary] during [dates]. The report will include the scope tied to that boundary, the methodology, test dates, severity-rated findings with evidence, and retest results for anything we fix. Testing is run by Helix Cyber, an independent provider. Does that meet what you need for our [Type 1 / Type 2] report?
If they ask for something specific, such as a named format or an attestation letter, tell us when you scope the test.
Frequently asked questions
How much does a SOC 2 penetration test cost?
With Helix, a typical single web app or API costs $3,000 USD black box or $4,000 USD gray box. White box with source code starts at $7,000 USD. Retesting is free and unlimited. Manual tests of a similar scope from traditional firms are commonly quoted at $8,000 to $14,000 or more.
Does SOC 2 require a penetration test?
Not explicitly. The Trust Services Criteria list penetration testing as one way to evaluate controls, and many auditors and enterprise customers expect one. If your controls say you run an annual pentest, the auditor will ask for the report. Our SOC 2 penetration testing requirements guide covers the detail.
Will my auditor accept an AI-led penetration test?
The auditor decides what evidence is sufficient, so check with them before you book. What auditors look for is a defined scope, a stated methodology, test dates, severity-rated findings with evidence, and proof of remediation. Helix reports include all of these, every finding is reproduced by a second agent, humans oversee the run, and an attestation letter is available.
When should I schedule the pentest for a Type 1 or Type 2 report?
For Type 1, finish the test and record your remediation plan before the report's as-of date. For Type 2, run the test and the retest inside the observation period, which is commonly 3 to 12 months. Testing early in the window leaves time to fix findings and show the retest results.
Is a vulnerability scan enough for SOC 2?
Usually not on its own. A scanner reports known patterns and leaves you to triage false positives. A penetration test tries to prove impact, such as one tenant reading another tenant's data. Auditors commonly send back scanner output presented as a pentest.
Black box or gray box for SOC 2?
For a SaaS product, gray box is usually the better fit. Test accounts let the agents check what auditors and customers care about most: access control between roles and tenants. Black box covers the public attack surface only.
How fast can we get the report?
Sign up and order in the portal today. The report is delivered in about 24 hours, counted from when the scope, the signed rules of engagement, and test access are confirmed. Traditional firms often need two to eight weeks just to schedule a test.
Are retests really free?
Yes. Retesting is free and unlimited for every engagement. Mark a fix ready in the portal and the agents attack it again, so your auditor sees both the finding and the verified fix.