Do I need a penetration test for SOC 2?
Short answer
SOC 2 does not explicitly require a penetration test, but it does require you to identify and manage vulnerabilities. In practice, most auditors and enterprise buyers expect a recent pen test as the strongest evidence you meet that bar.
Pen test vs vulnerability scan
A vulnerability scan is automated and broad; a penetration test is a manual, scoped attempt to exploit weaknesses. They serve different purposes, and a scan alone often won't satisfy a careful auditor.
What matters more than the test
Auditors care that you remediate findings and can show the closure loop. A pen test with unaddressed critical findings is worse than a smaller, well-remediated scope.