Blog & Articles SOC 2 Penetration Testing Requirements: What Auditors Actually Expect by Rebecca Sutton September 7, 2026 by Rebecca Sutton September 7, 2026 SOC 2 never uses the words “penetration test” but most auditors expect one anyway. Here is what CC4.1 actually requires, how often to test, and what a Type II audit … FacebookTwitterLinkedinEmail