Articles
Testing, audits, and the evidence in between
Written for the person who has to produce the artifact, not the person selling it. Every claim about what a framework requires carries the clause it comes from.
Audit operations · 5 min
The evidence worth generating before anyone asks for it
Audits fail on evidence far more often than on controls. The difference between a smooth audit and a scramble is whether records are produced as a byproduct of work or assembled by a person afterwards.
Audit operations · 5 min
Answering security questionnaires without losing a week each time
Security questionnaires are a tax on selling to enterprise, and most of the cost is re-answering the same questions in different formats. The fix is an evidence set assembled once, kept current, and mapped to the questions rather than to the forms.
AI security · 5 min
Your product has AI features. Does the audit care?
Neither SOC 2 nor ISO 27001 names AI. Both cover the system in scope, and an AI feature that is part of the product is part of that system. The practical pressure is arriving from enterprise questionnaires rather than from the frameworks.
AI security · 7 min
Prompt injection, explained for people who have to sign off on it
Prompt injection is content the model reads being followed as instruction. It becomes a security vulnerability rather than a curiosity at the moment the model has authority to act, and the thing to test is the path from attacker-controlled text to a privileged operation.
Audit operations · 5 min
Why auditors treat a scan and a penetration test differently
A vulnerability scan proves a tool ran. A penetration test proves a control works. That distinction is why an auditor assessing CC4.1 accepts one more readily than the other, and why PCI DSS numbers them as separate requirements.
Penetration testing · 6 min
What a good penetration test report contains
A penetration test report serves three audiences with different needs: engineers who have to fix things, leadership who have to decide what matters, and auditors who have to evidence a control. A report that only serves one creates translation work after the engagement ends.
ISO 27001 · 6 min
What to have ready before an ISO 27001 Stage 2 audit
Stage 2 audits the management system in operation, which means the auditor is looking for records that processes ran rather than documents saying they exist. The gap between a complete policy set and a passing Stage 2 is evidence.
AI security · 13 min
Four AI security incidents in 2026, and what they change about testing
Four disclosures between March and July 2026 changed what an AI security incident looks like. None involved a model behaving badly. Three were ordinary compromises of infrastructure that happens to serve AI, and one made opening a git repository sufficient for code execution. The novel element is tempo, not capability.
Penetration testing · 7 min
How to scope a penetration test without wasting half of it
Scope decides what a penetration test can find and what its report can be used to claim. The four decisions that matter are which systems, which environment, how much access the tester gets, and what is explicitly out of bounds.
ISO 27001 · 6 min
Does ISO 27001 require a penetration test?
ISO/IEC 27001 does not use the phrase penetration test. Annex A 8.8 requires management of technical vulnerabilities and A 8.29 requires security testing. ISO/IEC 27002:2022, the implementation guidance for those controls, names penetration testing directly, which is why certification bodies expect it at Stage 2.
SOC 2 · 6 min
How long a first SOC 2 actually takes
A first SOC 2 Type II usually takes four to eight months from decision to report. The audit itself is a small part of that. Most of the time goes to implementing controls that produce evidence, and to the observation window, which cannot be compressed.
SOC 2 · 6 min
What an auditor actually wants from a penetration test report
Auditors do not read penetration test reports for the findings. They read them for scope, dates, method and closure, because those are the four things that let a report support a control. Reports that bury those details create audit work rather than removing it.
SOC 2 · 7 min
Does SOC 2 require a penetration test?
SOC 2 does not require a penetration test. The AICPA Trust Services Criteria never use the phrase. In practice most auditors accept a penetration test as the evidence for CC4.1 and CC7.1, and a company with no security testing evidence at all should expect questions.
Penetration testing · 7 min
AI-assisted penetration testing should make evidence easier, not more opaque
Automation is useful in security testing when it removes repetitive work while preserving accountable human judgment. It stops being useful when it turns the assessment into an unexplained score or a report with no defensible method behind it.
Audit operations · 5 min
Why pen test buying stalls the audit before testing even begins
The slowest part of an assessment is usually not the testing. It is the handoff between the security buyer, the test provider and the audit workstream, and most of that delay is created during purchasing rather than during the work.
Penetration testing · 6 min
The pen test quote problem: why security buyers still cannot see the price
Penetration testing effort changes for knowable reasons: how much is in scope, how much context the tester gets, how fast evidence is needed, and whether testing continues after the report. A quote-only process does not make those inputs more accurate, it moves price discovery into a sales cycle.