Does ISO 27001 require a penetration test?

ISO 27001 requires management of technical vulnerabilities (Annex A 8.8). A penetration test is the standard way to demonstrate that control, and auditors expect the report plus evidence that findings were remediated.

What does the Strix Full Audit include?

Exhaustive AI-driven testing of your apps and APIs with custom scope and test accounts, business logic and attack chain testing, review by CREST-certified pentesters, a formal auditor-ready PDF report for SOC 2 and ISO 27001, fix pull requests for every validated finding, and a free retest. Scope and cost are agreed up front on a short scoping call.

How fast can I get the report?

Full Audit results are delivered the same day. Agents test in parallel, and the CREST-certified review happens on top of validated findings rather than from scratch.

Will my auditor accept an AI-driven pentest?

The Full Audit report is reviewed and signed off by CREST-certified pentesters and documents scope, methodology, findings with proof of exploit, severity, and remediation status, which is the evidence auditors ask for. Every finding is validated with a working exploit, so the report contains confirmed issues, not scanner output.

How is this different from a one-time Strix pentest?

The self-serve one-time pentest gives you broad coverage with validated findings and autofix PRs. The Full Audit adds deeper per-target testing, custom scope, CREST-certified human review, and the formal report format that SOC 2, ISO 27001, and enterprise customer reviews expect.

SOC 2 & ISO 27001 Penetration Testing, Same-Day Report

Trusted by security teams at

Why compliance pentests are usually slow and expensive

SOC 2 Type II and ISO 27001 auditors expect evidence that an independent party tested your systems. The traditional route is a consultancy engagement: weeks of scheduling, a five-figure invoice, and a PDF that is out of date by the time it lands. Strix Full Audit replaces the waiting with autonomous agents that test exhaustively, then puts CREST-certified pentesters on the review so the report stands up to your auditor.

What the Full Audit includes

Everything in a one-time Strix pentest, plus the depth and paperwork a compliance review needs.

Auditor-ready report

A formal PDF written for SOC 2 and ISO 27001 evidence requests: scope, methodology, findings, severity, and remediation status.

Reviewed by CREST-certified pentesters

Human experts validate the agents' results and sign off on the report, so it carries weight in an audit or customer review.

Business logic and attack chains

Deeper, exhaustive testing per target, including multi-step attack paths and the logic flaws automated scanners miss.

Custom scope and test accounts

Authenticated testing across roles and environments, scoped with you so the report covers what your auditor lists.

Same-day results

Agents run in parallel, so findings and the report arrive in hours instead of the weeks a consultancy schedule takes.

Free retest and fix PRs

Every validated finding ships with a fix pull request. Merge it and agents retest, so you can show closed findings, not open ones.

Which frameworks it covers

One engagement, evidence for the reviews you actually get asked for.

SOC 2 Type I and Type II

Independent penetration test evidence for the security trust services criteria your auditor samples.

ISO 27001

Technical vulnerability management evidence and a remediation trail for your ISMS.

Customer security reviews

A report you can share with enterprise procurement teams that ask for a recent third-party pentest.

Consultancy pentest vs Strix Full Audit

How a traditional compliance engagement compares.

Capability

Strix Full Audit

Traditional consultancy

Cost

A fraction of a consultancy engagement, scoped up front

Five-figure invoice per engagement

Time to report

Same day

Weeks of scheduling plus testing time

Auditor-ready report for SOC 2 and ISO 27001

yes

Reviewed by certified pentesters

yes, CREST-certified

yes

Depth

Exhaustive per target, including business logic

Limited by tester hours

Fix delivered

Merge-ready pull requests

Remediation advice

Retest

Free, on every fix

Often a paid add-on

Continuous coverage after the audit

Yes, with the Strix platform on every PR and deploy

no

Cost

Strix Full Audit

A fraction of a consultancy engagement, scoped up front

Traditional consultancy

Five-figure invoice per engagement

Time to report

Strix Full Audit

Same day

Traditional consultancy

Weeks of scheduling plus testing time

Auditor-ready report for SOC 2 and ISO 27001

Strix Full Audit

yes

Traditional consultancy

yes

Reviewed by certified pentesters

Strix Full Audit

yes, CREST-certified

Traditional consultancy

yes

Depth

Strix Full Audit

Exhaustive per target, including business logic

Traditional consultancy

Limited by tester hours

Fix delivered

Strix Full Audit

Merge-ready pull requests

Traditional consultancy

Remediation advice

Retest

Strix Full Audit

Free, on every fix

Traditional consultancy

Often a paid add-on

Continuous coverage after the audit

Strix Full Audit

Yes, with the Strix platform on every PR and deploy

Traditional consultancy

no

From issue to fix in seconds

Find critical issues, auto-validate, and auto-fix with merge-ready PRs.

←Issues/STR-00847

SSRF via URL Parameter in /api/proxy

OpenHigh · 8.6CWE-918

TL;DR

The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.

Impact

Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.

Location

acme/api · proxy-handler.ts:23

GET/api/proxy?url=

Severity

High

CVSS

8.6

Fix Effort

Low

Discovered

2h ago

Discover & Validate

Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.

FixReproduction

How do I fix it?

Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.

proxy-handler.ts:23-29Copy

23	23	const targetUrl = req.query.url;
24		const resp = await fetch(targetUrl);
	24	const parsed = new URL(targetUrl);
	25	if (!ALLOWED_HOSTS.has(parsed.hostname)) {
	26	throw new ForbiddenError("blocked");
	27	}
	28	const resp = await fetch(parsed.href);
25	29	return res.json(await resp.json());

✓Fix verified — vulnerability no longer exploitable

→PR #247 fix/ssrf-proxy-handler ready to merge

Auto-Fix

Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.

Frequently asked questions

Common questions about penetration testing for SOC 2 and ISO 27001.

SOC 2 does not name penetration testing as a mandatory control, but auditors routinely expect a recent third-party pentest as evidence that security controls work, particularly for CC4.1, CC6.1, and CC7.1 through CC7.4. Most companies run one at least annually and after major changes.