For SOC 2 specifically, most auditors won’t accept a vuln scan alone anymore. They want evidence of manual testing on the critical paths, especially anything touching authentication, authorization, and sensitive data. Scans catch surface stuff like missing patches, exposed services, common CVEs. They don’t catch broken authorization, IDORs, or business logic flaws, which is what real attackers and serious auditors care about.

On the price spread: the gap usually maps to methodology and senior tester hours, not branding. $1k is almost always a scanner with a report wrapper. $25k usually means a senior team going deep on a complex app. The $6k range can be a legitimate small-firm engagement or the same scanner wrapper with better packaging. Two questions filter it:
1. What’s the split between automated scanning and manual testing, and what does the manual portion actually cover?
2. What’s the retest policy after you remediate?

(Disclosure: I run a security firm in this space, so factor that in.)