Tell us what you need tested. A senior engineer, not a salesperson, replies with scope, timeline, and price.
Fixed price after a 15-minute call · Try before you buy · Your details are never shared
Not a scan report. Evidence your examiner accepts and your engineers can act on.
A redacted sample web-application report — the finding write-ups, proof-of-concept evidence and remediation your team would receive. No form required.
Download the sample report (PDF) →Enough for a small web application and its API, free retest included. Need more coverage? Buy more credits and spend them across web, API, mobile, cloud and network as priorities change; unused credits roll over quarterly. Continuous PTaaS subscriptions are quoted on scope.
Working to a fixed number? Tell us what it is. We scope a timeboxed test to fit it and agree what gets tested first, so you get the most coverage your budget allows — in writing, before testing starts.
Get my scoping callTSC-mapped testing, examiner-ready evidence, and a named engineer who knows what a SOC 2 auditor checks.
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.
Block quote
Ordered list
Unordered list
Bold text
Emphasis
Superscript
Subscript
A fixed process with dates you can plan around.
Everything here is verifiable on a third-party site or in your own report.
SOC 2 doesn't mandate a specific test, but auditors expect evidence that you evaluate security controls — and a penetration test mapped to the Trust Services Criteria is the strongest way to satisfy CC4.1 (monitoring) and CC7.1 (vulnerability detection). ioSENTRIX reports are built to drop into your SOC 2 evidence.
Engagements start at $6,400 — 40 credits at $160 each — covering a small in-scope environment with a free retest. Larger scopes use more credits, and unused credits roll over quarterly. Every quote is a fixed price in writing after a 15-minute scoping call.
Yes. For Type I we test at a point in time; for Type II we run testing across your audit period so you have evidence of controls operating over time — stronger than one annual snapshot.
Security (the common criteria) plus any of Availability, Processing Integrity, Confidentiality and Privacy that are in your report's scope. Every finding is mapped to the relevant criterion.
A TSC-mapped report with an executive summary, technical findings, verified remediation evidence and an attestation letter your examiner accepts.
A typical test takes 1–3 weeks including reporting; larger environments take 4–6 weeks. Free retesting confirms your fixes before the audit window closes.
Tell us what's in your SOC 2 scope and we'll scope a TSC-mapped test with examiner-ready evidence. No commitment, no sales call before the engineer call.
