Pentest vs audit: what each one proves and who does it
A security audit checks your controls, policies and records against a standard and ends in an opinion or report from an auditor. A penetration test is an authorized attack on a system and ends in findings with evidence. They answer different questions. Auditors often ask for pentest evidence, but the pentest does not replace the audit, and the audit does not find exploitable flaws.
A security audit asks "do your controls meet the standard?" A pentest asks "can someone break in?" Teams mix them up because both end in a report that a customer may request. They use different methods, produce different documents and come from different people.
Pentest vs audit: the short answer#
A security audit compares your controls, policies and records with a written standard. The auditor reads documents, samples evidence and interviews staff, then gives an opinion or a report. A penetration test is an authorized attack on a system by a tester, who records what worked and proves it with evidence.
The audit tells a customer that you run a defined set of controls. The pentest tells you which flaws an attacker can use today. Neither one stands in for the other.
Side-by-side comparison#
| Security audit | Penetration test | |
|---|---|---|
| Question | Do controls meet a standard? | Can the system be attacked successfully? |
| Method | Document review, evidence sampling, interviews | Authorized attack on a defined scope |
| Evidence | Policies, tickets, logs, screenshots, population samples | Requests, responses, screenshots, reproduction steps |
| Output | Auditor's report or opinion | Findings with severity, evidence and fixes |
| Standard | SOC 2 criteria, ISO 27001, PCI DSS | A method such as OWASP WSTG or NIST SP 800-115 |
| Done by | Independent auditor firm | Security tester or lab |
| Frequency | Per audit period or cycle | Per release or at least yearly, as set by you or your standard |
What does an audit report look like next to a pentest report?#
An audit report states scope, criteria, the auditor's opinion and any exceptions found in control testing. A SOC 2 report is an attestation, which means an independent CPA firm gives an opinion on your controls. It does not list exploitable bugs.
A pentest report lists findings. Each one has a severity, a description, evidence, reproduction steps and a fix. Ours also has a "Controls that held" section and a limits section. You can preview the layout in our sample report and read the method in how to read a penetration testing report.
Demonstration
Demonstration only. No real customer system was tested.
Audit exception, from a fictional "Harbor Notes" review: "Access reviews for production were not performed in Q2." The finding concerns a missing control record.
Pentest finding, same fictional app: "A viewer in tenant A can read notes of tenant B by changing the note ID in GET /api/notes/{id}." The finding concerns a working attack, proven by reading the record back from a second account.
How do SOC 2, ISO 27001 and PCI use pentests inside an audit?#
Each framework treats a pentest as evidence or as a stated requirement, and the wording differs.
- SOC 2: The 2017 Trust Services Criteria name penetration testing once, as an example in a point of focus under CC4.1 (ongoing and separate evaluations). The criteria text says use of the criteria does not require assessing whether each point of focus is addressed. SOC 2 does not mandate a pentest. Many auditors and customers still ask for one. See does SOC 2 require penetration testing.
- ISO 27001: The 2022 Annex A controls on technical vulnerabilities (8.8) and security testing (8.29) are the usual places for pentest evidence, based on secondary sources. See ISO 27001 penetration testing.
- PCI DSS v4.0.1: Requirement 11.4 asks for a defined methodology, and for internal and external penetration tests. The PCI SSC guidance says the tester must be organizationally separate from the management of the target systems. See PCI DSS penetration testing requirements.
In each case your auditor or assessor decides what evidence they accept. Ask before you buy.
When do you need one, the other, or both?#
Use this table as a starting point.
| Your situation | Likely need |
|---|---|
| Customers ask for a SOC 2 or ISO 27001 report | The audit, and usually a pentest as evidence |
| Customers send a security questionnaire | Answers, and often a pentest summary or letter |
| You are about to launch a product | A pentest first, an audit later |
| You must meet PCI DSS | Assessment and pentests, both defined by the standard |
| You want to know what an attacker can do | A pentest |
Common mix-ups#
Several other documents get called "audit" or "pentest" in questionnaires.
- Vulnerability scan: an automated check for known issues. It is not an audit and not a pentest.
- Readiness assessment: a gap review before an audit. It does not attest to anything.
- Attestation letter: a short letter from the tester that confirms a test happened. It does not prove you are secure. See pentest attestation letter.
- Compliance certificate: issued after an audit, not after a pentest.
What does each one miss?#
An audit can pass a company whose application has a serious flaw. The auditor samples controls and checks that they operate. The auditor does not try to bypass authorization in your API. A control such as "we run code review" can exist and operate while a specific endpoint still skips the ownership check.
A pentest can pass an application at a company with weak governance. The tester proves what is exploitable in the agreed scope and time. The tester does not check whether you review access quarterly, train staff or log changes. A clean test also covers only the scope, so a host that was not listed was not tested.
The two checks cover different gaps, which is why customers sometimes ask for both.
Which evidence goes to which request?#
Match the document to the request instead of sending everything.
| Request | Send |
|---|---|
| "Do you have a SOC 2 report?" | The SOC 2 report, not the pentest |
| "Do you pentest annually?" | Summary or attestation letter, dated, with scope |
| "Full pentest report" | Report under NDA, with open findings explained |
| "Describe your vulnerability management" | Your policy, plus scan and pentest cadence |
| "Show remediation" | Findings list with fix dates and retest result |
Keep the dates straight. A report that is 14 months old may not answer a question about annual testing. State the test date and the build or release that was tested.
A short checklist before the audit window#
- Ask the auditor which controls the pentest will support
- Agree the scope with the auditor, in writing
- Book the pentest early in the audit period
- Plan time for fixes and a retest inside the same period
- Keep the report, the fix tickets and the retest result together
- Confirm who may receive the full report and under what terms
Read after the pentest: remediation and retest for the fix and retest loop.
What to ask when a customer says "security audit"#
Reply with questions, not a document.
- Which standard or questionnaire do you mean (SOC 2, ISO 27001, your own)?
- Do you want a report from an independent auditor, or technical test results?
- How recent must it be?
- Do you need the full report, or a summary or letter under NDA?
Our customer security review page shows what a buyer-facing pack can hold. Excession Labs does not claim that any auditor or customer will accept a given report. Confirm what they accept before you buy.
Need a pentest you can act on?
Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.
Questions
Can a pentest replace a SOC 2 audit?
No. A SOC 2 report is an attestation by an independent CPA firm on your controls. A pentest report is a technical test result. Your auditor may use the pentest as evidence for some controls, and that is all.
My customer asked for a security audit. What do they want?
Ask. Some mean a SOC 2 or ISO 27001 report. Some mean a pentest report. Some send a questionnaire. Get the request in writing and name the document you can send.
Does a clean pentest mean I pass the audit?
No. The audit also covers policies, access reviews, change management and other controls that a pentest does not touch. A pentest result is one input.
Which should I do first?
If a deal needs a SOC 2 or ISO 27001 report, start with the audit timeline and fit the pentest early in it, so fixes and retest land inside the period. Ask your auditor for dates.
Sources
- AICPA TSP section 100, 2017 Trust Services Criteria (March 2020 update), hosted copy (checked 9 November 2026)
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (checked 9 November 2026)
- PCI SSC Information Supplement: Penetration Testing Guidance v1.1 (checked 9 November 2026)
- PCI DSS v3.2.1 to v4.0 Summary of Changes (requirement 11.4) (checked 9 November 2026)