SaaS penetration testing for SOC 2 compliance