Menu
Many teams assume a vulnerability scan satisfies the pen test expectation; automated scans and manual penetration tests are treated as distinct evidence types by auditors, and a scan alone is typically insufficient for CC4.1.
Pen test vs vulnerability scan
A vulnerability scan is automated, runs against a defined IP range, and produces a list of known CVEs. A penetration test is human-led, scoped to your application or infrastructure, and attempts to chain findings into actual exploitation. Auditors treat them as different evidence types. The scan demonstrates ongoing monitoring; the pen test demonstrates separate evaluation. Most auditors want to see both.
What “scoped” means
The pen test must cover the systems that handle data in your audit scope. If you are getting a SOC 2 for a SaaS product, the test should hit the production application, the supporting cloud infrastructure, and any admin interfaces. A pen test that covered only your marketing site does not satisfy CC4.1 for a product audit.
Remediation matters more than findings
What auditors actually check is whether you remediated the findings. A test with five findings and documented fixes within 30 days reads better than a clean test with no remediation history. Build remediation evidence into your CC4.1 file from day one.
Cost and timing
A scoped third-party pen test typically runs $8,000 to $25,000 for a SaaS product, takes 2 to 4 weeks, and should be timed to land inside or close to your audit period. Annual cadence satisfies most auditors; some industries (financial services, healthcare) push for semi-annual.