HackZero

Which platforms include a penetration test with SOC 2 compliance? Almost none of them do. Vanta, Drata and Secureframe automate the compliance program and refer the penetration test to a partner firm, so the standard SOC 2 purchase is three separate vendo

Which frameworks require a third-party penetration test? Three do: FedRAMP, the CSA Cloud Controls Matrix, and DORA. PCI DSS and NYDFS require a penetration test but explicitly accept an internal tester. SOC 2 and ISO 27001 require no penetration test at

How much does a SOC 2 audit cost? A SOC 2 Type 2 examination costs $7,000 to $50,000 in 2026 from a traditional CPA firm, and the whole first-year program runs $15,000 to $60,000 once the platform and the penetration test are counted. Most of that spread

Does ISO 27001 require penetration testing? No. Nothing in ISO/IEC 27001:2022 names penetration testing, in Annex A or anywhere else. But two controls, A.8.8 and A.8.29, require you to find technical vulnerabilities and to test security, and a penetration

SOC 2 compliance: what it is, what it costs, how long it takes There is no such thing as being SOC 2 certified. SOC 2 produces a report in which a licensed CPA firm gives an opinion on your controls. No software vendor can grant it, including us. What a p

CVE-2026-73649: a critical RCE we found in velocity.js We reported a critical remote code execution bug in velocity.js, CVSS 9.8, now tracked as CVE-2026-73649, fixed in 2.1.7. A template can read $x.constructor.constructor to reach JavaScript's Function

A cookie-leak bug we reported in tough-cookie We reported a cookie-leak bug in tough-cookie, a library pulled about half a billion times a month: a URL-parsing quirk let cookies scoped to victim.com leak to an attacker's host. We scored it 7.6 (High). The

A disabled key-size check we found in Tor's arti We reported a security-check bug in Tor's arti: a misplaced ! disabled an RSA key-size check, so any key size passed a test meant to allow only 1024-bit keys. Tor rated it low severity and fixed it in merge

What does PCI DSS require for penetration testing? Unlike SOC 2 or ISO 27001, PCI DSS flatly requires a penetration test. Requirement 11.4 mandates internal and external tests every 12 months and after significant changes, a retest to verify fixes, and se

A Function-constructor escape we fixed in JSONPath-Plus We reported and fixed a remote code execution escape in JSONPath-Plus, a library pulled 12 million times a week: its "safe" eval still handed back the Function constructor through a property read, so