Who it is for
- →Teams that ship weekly or faster
- →Products where AI assistants write a meaningful share of the code
- →Companies answering vendor questionnaires and SOC 2 audits every quarter
- →Leadership that wants evidence, not a date
How it runs
- Continuous
Every release, every rule
Each rule from your audit runs against the live product on every deploy. A regression is caught before it ships, not found by someone else.
- Monthly
New patterns
As the public record grows, so does the pattern library. New scenarios are added to your rule set and tested without a new engagement.
- Quarterly
Researcher review
A named researcher reviews what changed in your product and attack surface, and adjusts scope and rules with your team.
- On demand
Evidence
One page for the board and a control-by-control map for auditors and customers, generated from live test results.
What you get
- 01
- Live rule statusEvery plain-English rule, passing or failing, with the last test time.
- 02
- Release gateRules run in your pipeline; a failing rule blocks the release or pages a human, your choice.
- 03
- Evidence on demandSOC 2, ISO 27001 and customer questionnaire answers backed by test results, not screenshots.
- 04
- A named researcherOne person who knows your product end to end.
Questions
What is continuous security assurance?
Continuous security assurance means every security control is expressed as a testable rule and re-tested automatically on each release, so security status is always current.
Does it replace SOC 2 or a pentest?
It produces the evidence SOC 2 and vendor reviews ask for and reduces what an annual pentest can find, but it is not a certificate. Your auditor receives a control map backed by live test results.
How does it handle AI-written code?
Rules test the behaviour of the deployed product, so it does not matter who or what wrote the code. A generated handler that skips an ownership check fails the same rule a human-written one would.
What does it cost to run in our pipeline?
Rules run against a staging or production deployment with read-only access. No agents are installed; the release gate is a single check in your existing CI.