Running production workloads in AWS means your compliance auditor, your enterprise customer's security team, or your insurer will eventually ask for a penetration test report. This guide breaks down what a proper cloud and AWS penetration test needs to cover in 2026, and how to pick the right scope before you sign anything.
Why this matters
A generic network scan doesn't tell you anything useful about an AWS account. Misconfigured S3 buckets, overly permissive IAM roles, and exposed Lambda functions don't show up on a Nessus scan pointed at an IP range.
Compliance frameworks have caught up. ISO 27001:2022 Annex A control 8.29 requires security testing during development and acquisition, and auditors increasingly expect that testing to reflect your actual cloud architecture, not a generic office network. SOC 2 CC7.1 asks the same question in different words: how do you detect vulnerabilities before an attacker does?
If you're working toward SOC 2 compliance for UK SaaS companies, a cloud-relevant pentest report is one of the evidence items an auditor will ask for by name.
Who this is for
This guide is for SaaS founders, engineering leads, and compliance managers running production infrastructure on AWS who need a penetration test to satisfy ISO 27001, SOC 2, Cyber Essentials Plus, or a customer security questionnaire. If your infrastructure is entirely on-prem or you haven't touched an AWS console, this isn't your guide.
What to look for in penetration testing for cloud infrastructure and AWS
AWS-specific methodology
Ask the tester directly whether they test against AWS-native services: IAM policies, S3 bucket ACLs, security groups, EKS clusters, Lambda execution roles. A firm quoting a flat rate without asking for your AWS account structure hasn't scoped the job properly.
Cloud configuration review vs. infrastructure pentest
These are two different exercises. A configuration review checks your AWS account setup against a benchmark like the CIS AWS Foundations Benchmark. An infrastructure pentest actively tries to exploit what it finds. You need both, not one instead of the other.
Compliance-mapped reporting
The report needs to reference the control it satisfies - Annex A 8.29 for ISO 27001, CC7.1 for SOC 2, or the vulnerability management requirement for Cyber Essentials Plus. A report that just lists CVEs without mapping to your framework creates extra work at audit time.
Retesting included
A one-off report with no retest is close to worthless. You need proof the findings were fixed, not just a list of what was broken in 2026 with no follow-up in 2027.
Turnaround and cadence
Most auditors expect an annual retest cadence, with an additional test after any major architecture change - a new VPC, a new customer-facing API, a migration to a new region. Confirm the cadence up front, not after the first invoice.
Evidence handoff format
The report needs to land somewhere your compliance platform can use it as evidence, not sit in a PDF in someone's inbox. If you're not sure how a test should even be scoped before you get quotes, read how to scope a penetration test before you buy one first.
Top picks: the test scopes that matter
AWS cloud configuration review - the foundation
This checks your account against the CIS AWS Foundations Benchmark - IAM password policies, root account usage, S3 bucket public access, CloudTrail logging. It's the cheapest test to run and catches the highest volume of findings per pound spent. Verdict: Buy.
External network penetration test - the baseline auditors expect
This is what ISO 27001 and SOC 2 auditors mean when they say "penetration test" without further specification. It targets your internet-facing assets - load balancers, API gateways, exposed management ports. Skip this and your audit stalls. Verdict: Buy. For help picking a firm that actually understands AWS scoping, best penetration testing companies for UK small businesses is worth reading before you get quotes.
Web application penetration test - for customer-facing apps
If you ship a web app or API that customers log into, this test targets authentication, session handling, and business logic flaws sitting on top of your AWS infrastructure. Fintech and regulated SaaS should treat this as mandatory rather than optional - see penetration testing for fintech startups for scope specifics. Verdict: Consider if you have a customer-facing app; Skip if you're purely internal tooling.
Red team / internal engagement - the wildcard
A red team exercise simulates a sustained attacker, not a scoped test window. It's expensive, takes weeks, and only makes sense once you have a mature security programme and something worth defending at scale - often relevant for MSPs managing multiple client environments, covered in penetration testing for MSPs with multiple clients. Verdict: Wait until you've passed your first ISO 27001 or SOC 2 cycle.
Turn pentest evidence into audit-ready proof
Automate how ISO 27001 and SOC 2 evidence gets collected and mapped.
What to avoid
- Fixed-price quotes with no scoping call. If a firm quotes you before asking about your AWS account structure, VPC count, or number of Lambda functions, the quote is a guess.
- Testers who ask for root AWS credentials. A properly scoped test uses a read-only or narrowly scoped IAM role, never root access.
- Reports with no remediation retest. A list of findings without a fixed-and-verified follow-up doesn't satisfy most auditors in 2026.
Verdict comparison
| Test type | Frequency | Maps to | Verdict |
|---|---|---|---|
| AWS cloud configuration review | Every 6-12 months | ISO 27001 Annex A 8.29, CIS AWS Benchmark | Buy |
| External network pentest | Annually | ISO 27001, SOC 2 CC7.1, Cyber Essentials Plus | Buy |
| Web application pentest | Annually or per major release | SOC 2, customer questionnaires | Consider |
| Red team engagement | After programme maturity | Advanced assurance, MSP contracts | Wait |
Frequently asked questions
One last thing
Most teams treat the pentest report as the finish line. It's the start of the paperwork: mapping findings to your control framework, tracking remediation, and having the evidence ready the next time an auditor or a customer's procurement team asks. Automating that evidence chain is exactly what OneClickComply handles - Seriously Simple Cyber Compliance means the report doesn't just sit in a folder, it feeds straight into your audit trail.