Pentesting for SOC 2

Requirement summary

The entity identifies risks to the achievement of its objectives across the organization and analyzes them as a basis for deciding how the risks should be managed. A point of focus is estimating the significance of the risks identified, including their likelihood and impact.

Official source: SOC 2 report description criteria

AISafe’s reproducible findings, prioritized by severity and exploitability, give the entity a measured basis for estimating the significance of the technical risks it has identified.

Requirement summary

The entity selects, develops, and performs ongoing or separate evaluations, including continuous monitoring, external assessments, vulnerability scans, and penetration testing, to ascertain whether controls are present and functioning.

Official source: SOC 2 report description criteria

AISafe provides the independent technical testing and reproducible findings that feed ongoing and separate evaluations of the vulnerability and monitoring controls.

Requirement summary

The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events and meet the entity’s objectives.

Official source: SOC 2 report description criteria

AISafe’s web and code audits test whether those access controls actually hold: broken authentication, privilege escalation, and excessive authorization are exactly what the agents probe for.

Requirement summary

The entity implements logical access security measures to protect against attacks from sources outside its system boundaries.

Official source: SOC 2 report description criteria

AISafe replays the external attacker’s perspective: blackbox testing and unauthenticated discovery surface exactly the exposure this criterion requires you to prevent.

Requirement summary

The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software, including unauthorized software installation and tampering.

Official source: SOC 2 report description criteria

AISafe code audits and dependency checks look for unauthorized or suspicious software paths, malicious libraries, and configuration points that would allow improper code to run.

Requirement summary

The entity uses detection and monitoring procedures to identify configuration changes that introduce new vulnerabilities and susceptibilities to newly discovered vulnerabilities, including monitoring infrastructure and software, change detection for unknown or unauthorized components, periodic vulnerability scans, and anomalies that indicate security events, with timely remediation.

Official source: SOC 2 report description criteria

AISafe’s recurrent scans, change validation, and anomaly analysis help demonstrate that newly discovered vulnerabilities and unauthorized components are detected, prioritized, and fixed.

Requirement summary

The entity authorizes, designs, develops, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. Points of focus include tracking system changes and protecting confidential information through the change lifecycle.

Official source: SOC 2 report description criteria

AISafe tests changes before they reach production and after deployment, so findings tie back to specific changes, supporting the requirement to track and protect changes through the lifecycle.