A pentest is not a checkbox your auditor stamps and forgets. Here is what SOC 2 penetration testing actually needs to prove, how it maps to the Common Criteria, and the report details auditors ask for.