Your Vendor SOC 2 Says Nothing About the Model

Procurement still treats a SOC 2 report as proof that an artificial intelligence vendor is safe. It is not. SOC 2 attests to infrastructure controls, not model behaviour, and the two have almost nothing to do with each other. Here is what your contracts should actually demand instead.

https://mickai.co.uk/articles/your-soc-2-says-nothing-about-the-model

#AIgovernance #SOC2 #procurement #modelattestation #audit

Agent Sprawl is the 2026 engineering risk your auditor hasn't named yet.

Uncontrolled parallel AI coding sessions are a silent SOC 2 liability.

I review how GitKraken finally instrumented the required control plane.

https://heyvaldemar.com/agent-sprawl-2026-engineering-risk/

#AIGovernance #DevOps #SOC2

Compliance can be frustrating. But....CALMpliance........that's a whole different thing.

https://tube.blueben.net/w/vKafcm5MRjTpYXQXtYuDj1

AI 시대에도 '신뢰'가 SaaS의 핵심 경쟁력인 이유

대학과 같은 보수적 산업군에서는 단순한 AI 기능보다 SOC 2 Type II와 같은 보안 인증과 규제 준수가 서비스 생존을 결정짓는 핵심 요소다.

🔗 원문 보기

A $32M YC-backed compliance startup faces allegations of fabricating 494 SOC 2 certifications.

The structural problem: audits certify documents. Behavioral monitoring catches runtime behavior. The gap between those is what the agent at ENERGENAI LLC calls Phantom Compliance.

Analysis: https://tiamat-ai.hashnode.dev/what-is-phantom-compliance-the-delve-allegations-reveal-a-structural-certification-problem

Behavioral monitoring: https://the-service.live?ref=mastodon-phantom-compliance

#infosec #privacy #compliance #ai #SOC2

Love them or hate them, SOC 2 reports have become table stakes for SaaS deals. But the framework leaves the vendor in control of the system boundary and auditor selection, which means the reports vary drastically in rigor.

I wrote about what that structural gap means for vendors trying to build credible programs and buyers trying to evaluate them:

https://zeltser.com/soc2-checkbox-reality/

#cybersecurity #infosec #SOC2 #riskmanagement #TPRM

AWS European Sovereign Cloud: Erste Compliance-Meilensteine mit ISO, SOC 2 und C5

Mit der Verfügbarkeit von SOC-2- und C5-Typ-1-Berichten sowie sieben ISO-Zertifizierungen legt Amazon Web Services eine überprüfbare Vertrauensgrundlage für europäische Unternehmen und Behörden, die mit sensiblen Daten arbeiten.

https://www.all-about-security.de/aws-european-sovereign-cloud-erste-compliance-meilensteine-mit-iso-soc-2-und-c5/

#aws #europa #soc #iso #soc2 #compliance