SOC 2 Penetration Testing: What Auditors Actually Check For (And Where Most Programs Fail)

Day three of a SOC 2 Type II audit. The auditor pulls up the penetration testing section of the audit program and asks: "Can you show me evidence that exploitable vulnerabilities identified during you