A pentest for SOC 2 and ISO 27001 audits

What you get

Every finding in the Audit Pentest report is validated before it is included. The report comes with an attestation signed by Cyphlon (DIFC) and a re-test of fixed findings.

• A proof of concept for each finding.
• Agent results within about two hours of the start.
• A re-test within 30 days of the report.
• Two credits, the pentest and its re-test, valid for 12 months.

Before you buy

Designed to be submitted as audit evidence. Confirm scope with your auditor.

If your auditor has specific requirements, tell us before you buy and we will say whether the Audit Pentest meets them.

Pentest Pass or Audit Pentest?

It is a real test of your running app, automated by our agentic pentester (black box) or agentic DAST (white box), with a proof of concept for every finding, usually within two hours. It is not a manual penetration test and not audit evidence. For SOC 2 or ISO 27001, use the Audit Pentest.

How it runs

1. Add the target. A domain, hostname or IP address. Mark it staging (recommended) or production.
2. Prove it is yours. Add a DNS TXT record at _dso-verify.<host>, or serve the file /.well-known/dso-site-verification.txt. The proof lasts 90 days.
3. The agent attacks. Reconnaissance, fuzzing and injection tests. Test accounts you save let it reach signed-in pages.
4. You get the report. Each finding comes with a proof of concept. Findings join your other results, where you can retest them after a fix.

What a pentest report is not

A report is one piece of evidence. It does not make an organisation compliant on its own, and no tool can.