Automated testing, manual penetration testing and red teaming: what is acceptable?
Choose automated checks, assessor-led penetration testing and red-team exercises against your security objectives and applicable obligations.
Day: October 30, 2026
How to review a vendor penetration-test report
Turn a test report into a documented accept, clarify or escalate decision based on scope and unresolved risk.
AI application security testing: scope, permissions and reassessment
Scope AI application security evaluation around data flows, retrieval permissions, tool actions, configuration and material changes.
Kubernetes security assessments: what a container scan leaves out
Scope Kubernetes assessment across applications, workloads, cluster administration, isolation and managed-service responsibilities.
Cloud security testing: scope, identity and shared responsibility
Plan cloud security assessment scope around accounts, identities, data services, configuration and shared responsibility.
Internal and external network testing: two different questions
Define external and internal network assessment boundaries, starting access, coverage, operational safeguards and retest evidence.
Web application and API penetration testing: defining the right scope
Define web application and API assessment scope by architecture, user roles, customer separation, business workflows and verification evidence.
When Do Third-Party Risk Tools Actually Help?
Choose tools for demonstrated workflow problems, and keep the service-specific risk decision with an accountable person.
Can We Manage Third-Party Risk Without Dedicated Software?
A shared register, controlled evidence storage and assigned actions can support a workable process when the team can keep them current.
What Should We Ask a Vendor About Its Fourth-Party Dependencies?
Ask about the subcontractors and other dependencies that could affect your service, and how your vendor oversees them.
Contact a SOC 1 or SOC 2 Consultant Now
Vulnerability Assessment and Penetration Testing
Get Our Emails
SOC Reporting Guide
Menu
Popular SSAE Resources
Controls at a Service Organization: Policy and Evidence
A written policy describes intended work; operating evidence helps show whether the relevant activity was actually performed.
Firewall Controls in SOC 1 and SOC 2: A Practical Example
See how a firewall control can connect risks, approved rules, monitoring and evidence without treating one technology as a universal SOC requirement.
Which Vendors Need the Most Oversight?
Prioritize the service by its consequences, access and replaceability. Use risk tiers to direct work, not to hide judgment behind a score.
SOC 3 Reports: General Use, Scope and Limitations
Learn how a general-use SOC 3 report differs from SOC 2 and why historical WebTrust and SysTrust terminology should not define a current report.
What Does Third-Party Risk Management Cover Beyond Reviewing a Vendor?
Start with the service your organization depends on, then connect review findings to decisions, ongoing oversight and an exit plan.
SOC Report Contract Language: What Should You Specify?
Discuss the report type, service scope, coverage and delivery terms needed in a contract rather than relying only on an old standard number.