The four buckets every AWS SOC 2 team ends up in
If you passed SOC 2 Type 2 and don't have a dedicated DevSecOps hire, your open findings almost certainly cluster into the same four buckets. Here's what they look like, and why the finicky ones…
Field notes on AWS compliance, SOC 2, and the work between finding and fix.
Practical writing for founders, CTOs, and security leads who need compliance to support the roadmap, not consume it.
Compliance for Startups (And the Devs Who Are Their Own DevOps Team)
Selling into regulated industries? You will be asked to prove you take security seriously. What you will get asked for, what actually applies to you, and what it costs to find out late.
We cleared our SOC 2 gap assessment in 48 hours (and you can too!)
How Tudovu used compliance-native DevOps, IaC, and AI agents to turn weeks of audit remediation into two days of focused work.
Configuration Drift: The Silent Killer of SOC 2 Compliance
Your SOC 2 report describes your infrastructure on the day the auditor looked at it. Configuration drift is what happens every day after that.
SOC 2 on AWS, How we built an AI Agent that Automatically Remediates SOC 2 Issues
Can AI Agents be used to fix or 'remediate' issues identified during a SOC 2 audit? Here's how we've built an agent that saves dozens of hours