For SOC 2 programs

SOC 2 compliance, made boring.

Continuous monitoring against your live app, with evidence for the trust services criteria. Audit-ready exports so your next SOC 2 cycle is paperwork, not a fire drill.

Get free report See pricing

Trust services criteria

The controls Barrion watches, around the clock.

Security (CC)

Common criteria, continuously checked

We watch the security control surface that every SOC 2 report covers: TLS, headers, auth surfaces, exposed services, and obvious misconfigurations. New findings show up at the next scheduled scan.

Availability

Uptime and exposure, in one view

Track external availability of the surfaces you list in your SOC 2 scope. We flag DNS, certificate, and reachability regressions so an outage doesn't become an audit finding.

Processing integrity

Catch the controls that drift

Things like missing rate limits, broken CORS, and weak cookie flags break processing integrity quietly. We surface them with a clear before/after and the exact remediation step.

Confidentiality

Keep tenant data on the right side of the wall

We check TLS-in-transit on every in-scope surface, cookie scoping (HttpOnly, Secure, SameSite) on auth and session cookies, access-control posture on tenant-scoped endpoints, and look for plaintext credentials or tokens leaking through response headers and error pages.

Privacy

Catch PII before it leaves the perimeter

We flag PII exposed on public surfaces, in error pages, and in sitemaps, check your cookie-banner and consent posture against what's actually set pre-consent, and verify referrer-policy hygiene so user identifiers don't ride along to third parties.

Pentest evidence

Testing evidence for SOC 2.

SOC 2 doesn't require a pentest. Many auditors accept one as evidence for CC4.1 (evaluations of whether controls work) and CC7.1 (finding vulnerabilities), and enterprise customers usually ask for the report. Monitoring can't answer that. Barrion's AI pentest produces the report as evidence that supports those criteria.

Report

Mapped to OWASP WSTG

Each AI pentest report comes as PDF, XLSX and JSON with an OWASP WSTG coverage matrix. Your auditor sees what was tested, not only what was found.

Review

A security engineer reviews

From Standard up a security engineer reviews the findings. Deeper tests come with a report signed off by that engineer.

Retest

Free retests show the fix

Retesting the issues a pentest found costs nothing. The evidence then shows the finding and the fix, which is the part auditors ask about next.

Continuous

Testing that keeps running

The pentest reruns on a schedule or on demand. Each run labels earlier findings as new, still open, resolved or regressed.

Findings are checked against your live app before they're reported. Confirmed ones come with the request and response, and unconfirmed ones are kept as lower-confidence leads. The monitoring below is the second layer: it keeps a timestamped record between tests.

See AI pentesting Sample pentest report

How Barrion supports SOC 2

Evidence on autopilot, not on your calendar.

Continuous monitoring

Daily scans, not annual panic

Scheduled passive scans against your live app on a cadence you choose. When a scan finds a control has regressed, it's in your dashboard and your Slack channel.

Audit exports

PDF and CSV evidence for your auditor

One-click exports with findings, severity, and timestamps. Drop them into your audit folder and you're done.

Criteria evidence

Evidence for CC and A criteria

Findings come with severity and fixes you can cite against the relevant trust services criteria, so most of the evidence is already gathered.

Alerting

Email and Slack, no noise

Deduped alerts on new and re-opened findings. You hear about regressions, not the same finding five times in a row.

How we fit

Continuous evidence, not a yearly scramble.

SOC 2 is a continuous-controls report. Auditors don't just want to know your controls existed in October, they want to see they were operating across the whole observation window. Barrion runs on a cadence, keeps every finding timestamped and de-duplicated, and exports the trail as PDF or CSV. That's the evidence your auditor asks for, ready before they ask.

Every finding has a severity and fix you can cite against the trust services criteria, so most of the evidence is already gathered. You spend your time fixing things, not assembling artifacts the night before an audit walkthrough.

✓Daily or weekly scheduled scans against your in-scope surfaces
✓Findings you can cite against the relevant CC or A criterion
✓Timestamped history of when a control regressed and when it was fixed
✓PDF and CSV exports that support your auditor's evidence requests
✓Production-safe by default, no state-changing requests

Evidence example

A control mapping, ready for your binder.

How Barrion's checks line up with SOC 2 trust services criteria controls. Exports carry CWE, OWASP WSTG and CVSS references rather than control tags, so use this as a guide when you cite the evidence:

{
  "tls_strong_ciphers": "CC6.1",
  "security_headers_hsts": "CC6.6",
  "auth_session_cookie_secure": "CC6.1",
  "rate_limiting_enabled": "CC6.6",
  "dependency_vulnerabilities": "CC7.2",
  "logging_anomaly_detection": "CC7.2"
}

FAQ

SOC 2 with Barrion, answered.

Do we need a pentest for SOC 2, or is monitoring enough?

SOC 2 doesn't require a pentest. Many auditors accept one as evidence for CC4.1 and CC7.1, and enterprise customers usually ask for the report. Monitoring shows your configuration kept operating across the window. It doesn't test your app the way an attacker would. Barrion's AI pentest covers that: a WSTG-mapped report, reviewed by a security engineer from Standard up, with free retests of what you fix. It can rerun on a schedule or on demand.

What's actually in scope for SOC 2 with Barrion?

Barrion covers the external, observable side of your security and availability controls: TLS, security headers, DNS and email auth, exposed services, checked by passive monitoring. The AI pentest tests the application itself, including behind login. We don't replace a GRC platform like Vanta or Drata for policy, HR, and vendor management. We sit alongside them and produce the technical evidence those tools ask you to upload.

How does this help us get audit-ready?

Your auditor wants evidence that controls are operating continuously, not just on the day you ran a scan. Barrion runs on a schedule, keeps a full history of every finding with timestamps, and exports the whole thing as a PDF or CSV you can cite against the trust services criteria. You hand that to the auditor as evidence of continuous monitoring.

How often is evidence refreshed?

Scans run daily on the Business plan and weekly on Essential, with on-demand scans any time. Every run produces a fresh timestamped artifact. For SOC 2 Type II you generally want a year of cadence-consistent evidence, which is what the history view gives you.

Is it safe to run continuous scans against production?

Yes. Default scans are read-only and don't submit forms, change state, or touch destructive endpoints. If you want testing behind login, run an AI pentest with credentials. The SOC 2 monitoring cadence is production-safe out of the box.

Recommended tools for SOC 2

Tools that produce trust criteria evidence.

Compliance

Start your SOC 2 evidence trail.

Run an AI pentest and give your auditor a dated report to cite against the trust services criteria. Not sure SOC 2 needs one? Read the guide.

Start an AI pentest Is a pentest required for SOC 2?