cyber.hendryadrian.com
Security Insights · aikido.dev

Aikido Maps Its Security Platform to SOC 2 Type 1 and Type 2 Evidence Needs

· Original article ↗

Summary

Aikido says its security platform can generate SOC 2 evidence through continuous scanning, remediation tracking, access checks and CI/CD gates. The article contrasts Type 1 snapshot evidence with Type 2 evidence collected across an audit period.

Key points

  • SOC 2 Type 1 assesses whether controls are appropriately designed at a point in time; Type 2 evaluates whether they operated effectively throughout a period, typically 3 to 12 months.
  • Aikido says its scanning tools, cloud posture checks and remediation workflows can provide exportable evidence for controls covering access, encryption, software integrity and vulnerability management.
  • The platform’s CI/CD gates can block pull requests or releases when issues exceed a configured severity threshold; the article says gate decisions, overrides and exceptions are logged.
  • Aikido describes its AI pentesting as testing applications, APIs and infrastructure for exploitable flaws, with reports showing what was tested and what vulnerabilities were found.
  • The article recommends starting continuous scanning and SLA tracking before a Type 2 audit period begins, since evidence cannot be collected retroactively.
  • Aikido notes that a tool alone will not pass an audit; auditors may also require policies, procedures, risk assessments, access reviews and incident response processes.

Article Details

Topic
How Aikido supports SOC 2 Type 1 and Type 2 compliance by consolidating security controls and audit evidence.

Vendors

AikidoThat's what Aikido Security can do for application and cloud security. Here's how it maps to what SOC 2 actually asks for, and where it fits differently depending on whether you're pursuing a Type 1 or Type 2 report.

Products

AikidoThat's what Aikido Security can do for application and cloud security. Here's how it maps to what SOC 2 actually asks for, and where it fits differently depending on whether you're pursuing a Type 1 or Type 2 report.Aikido Agentall feed into a risk-based prioritization process. When exploitability analysis is enabled, the Aikido Agent reads how a vulnerable package is used in your repositories and containers. Every run is recorded in aAikido Infinitereports show everything that was tested and the vulnerabilities found. And for ongoing testing, Aikido Infinite is continuous AI pentesting.

Related Articles