Pentest evidence for SOC 2.From every release.

Not explicitly. The criteria ask for vulnerability identification, independent evaluation, and remediation, and a penetration test is how auditors expect you to evidence them. Most auditors ask for at least one test inside the Type II observation period.

Auditors set their own evidence standard, and most accept a report that shows scope, method, validated findings, and verified fixes. Parameter's report contains all four, with a working exploit behind every finding. Ask your auditor before the audit window opens; we can walk them through a sample report.

The criteria say ongoing. The timing rule most auditors apply: for a Type I report the test can fall any time in the 12 months before the report date; for a Type II it has to happen during the audit period. Testing every release gives you dated reports across the whole window with no scheduling.

Scope, methodology, every validated finding with its proof of concept, the fix, and the re-test result, plus an executive summary. A customer-facing version omits the details of your stack.

No, and the difference is the one auditors check. A scan lists possible weaknesses; a penetration test proves them. Every Parameter finding ships with a working exploit and reproduction steps, and the report states scope and method, which is what separates it from scanner output. The same report answers enterprise security reviews, which usually ask for the most recent pentest.

Manual engagements quoted on the market run from about $5,000 for a shallow test to $15,000 to $30,000 for a thorough one, once a year. Parameter is one annual contract scoped to the environment covered, and it tests every release, so the cost per test falls the more you ship.

Parameter holds a SOC 2 Type I report, with the Type II observation period underway. Details are on the trust center.