SOC 2 is the right starting point for most SaaS startups selling to US-based businesses. ISO 27001 becomes relevant when you are selling to enterprise customers in Europe, the UK, or regulated industries that specifically require it. You rarely need both at the same stage, and choosing the wrong one wastes significant time and money.

TL;DR
SOC 2 is the US standard, faster to achieve (3 to 9 months for Type I or II), and what most US SaaS buyers ask for. ISO 27001 is the international standard, more rigorous, takes longer (9 to 18 months), and is expected by European enterprise buyers and regulated industries. Start with SOC 2 unless your primary market or a specific large customer requires ISO 27001. Both frameworks expect penetration testing in a complete program. One engagement from 3,000 can often support both if the same systems are in scope for your SOC 2 and ISO work (the SOC 2 in-scope system and the ISO 27001 ISMS boundary are not always identical, so align this with your auditors in scoping).

What Is SOC 2?

SOC 2 (System and Organization Controls 2) is a security audit framework developed by the American Institute of Certified Public Accountants (AICPA). It is not a certification but an audit report, produced by an independent CPA firm, that attests to whether your security controls meet the Trust Services Criteria.

When a developer leaves your SaaS company, you revoke their Okta access, disable their GitHub account, and rotate API keys. But what happens to the AI agent they built last month, the one that still has standing access to your production customer database?

We've spent the past six months testing AI implementations for European B2B SaaS companies, and we keep seeing a pattern that should concern every technical founder: orphaned AI agents create persistent access paths that traditional security audits miss. This is not theoretical. We found production agents with full database access whose creators had left the company four to six months earlier.

Securing these systems takes a different approach than securing traditional software. AI agents don't just run code. They make autonomous decisions about what data to access and when.

The identity problem: AI agents don't show up in your IAM audit
Your identity and access management system knows about human users and service accounts. But does it know about the LangChain agent your backend engineer spun up to automate customer support ticket classification?

The honest answer: earlier than you think

The right time to get your first pentest is before someone asks for it.

That sounds obvious. But for most early-stage teams, security is the thing that gets deferred until it can't be anymore. There is always something more pressing: a feature to ship, a deal to close, a hire to make.