Your SOC 2 evidence pipeline is the audit
Most SOC 2 pain in year two is not control failure. It is the cost of collecting evidence by hand, every quarter, forever.
1 min readPractical guidance,published in the open
Remediation guides our engineers actually hand to clients, executive briefing notes for the board pack, and a glossary written without the marketing layer.
Fixing IDOR without breaking your API
Insecure direct object references are the most common high-severity finding we report. The usual fix — swapping IDs for UUIDs — does not actually fix it.
2 min readCMMC Level 2: shrinking the assessment boundary
The largest cost driver in a CMMC engagement is not the controls. It is how much of your environment you let into scope.
1 min readKubernetes RBAC: four misconfigurations we find every time
Cluster-admin bindings, wildcard verbs, secret-reading service accounts, and the escalate verb. All four are cheap to fix.
1 min readWhat “residual risk” actually means
A short definition, and the two questions a board should ask whenever the phrase appears in a paper.
1 min readCPCSC is coming: what Canadian suppliers should do in the next 90 days
Requirements flow down the supply chain, which means subcontractors are affected by contracts they never signed.
1 min readTell us what triggered the search. We will scope to that.
We reply to every assessment request within one business day.