Compliance
Pentest evidence your auditor can use.
Most security frameworks expect regular, independent testing and proof that you fixed what was found. Aveas produces that proof as part of the work, not as a scramble before the audit.
Pentest evidence for SOC 2 · ISO 27001 · HIPAA · PCI DSS audits
Our part, and your auditor's
What Aveas does
- Tests your systems independently, to a stated scope and method
- Reports findings with severity, evidence and fix guidance
- Retests fixes and records the result
- Issues a report and a letter of attestation for the engagement
What Aveas doesn't do
- Certify your company (certification comes from your auditor or certification body)
- Guarantee an audit outcome (pentesting is one control among many)
- Replace a compliance platform (reports are designed to drop into one)
How Aveas supports each framework
SOC 2
SOC 2 auditors look for evidence that you identify and address security risks. A recent, independent pentest with tracked remediation is common evidence for that. Aveas gives you a dated report, the retest status of every finding and, with continuous testing, evidence across the audit period, not just one day of it.
ISO 27001
ISO 27001 asks you to manage technical vulnerabilities and test your controls. Aveas reports map findings to clear owners and remediation, so they fit into your risk treatment and your internal audit records.
HIPAA
The HIPAA Security Rule expects you to assess risks to electronic protected health information and evaluate your safeguards. Aveas tests the applications and APIs that handle that data and documents what was tested, what was found and what was fixed.
PCI DSS
PCI DSS requires regular internal and external penetration testing and retesting after fixes (requirement 11.4). Aveas tests in-scope applications and infrastructure to an agreed method and documents retesting.
Note: PCI's quarterly external vulnerability scans must be done by an Approved Scanning Vendor (ASV); Aveas pentesting doesn't replace that scan.
What you hand your auditor
- Report: scope, dates, method, tester, findings with severity and evidence, and remediation status.
- Retest record: which findings were fixed, when, and confirmed by whom.
- Letter of attestation: a short summary of the engagement for auditors and customers' security reviews.
- History: earlier engagements and continuous scanning results, so you can show testing over time.
Less chasing
Remediation status updates as engineers close tickets and we retest them, so you can see where things stand without asking. When the auditor asks "is this actually fixed?", the answer has a date and a name on it.
For enterprise security questionnaires too
Buyers ask when you were last tested and what was found. The letter of attestation answers that in one page, without sharing the full findings.
Aveas is invite-only.
We take on a small number of teams at a time, so every engagement gets a named pentester and a real scoping call. Tell us what you need to test and when your audit is.