Cybersecurity Insights & Expert Analysis
‍

There is no AI-specific SOC 2 and no AI trust services category. What there is, is an existing criterion your AI system quietly stopped satisfying. Where AI systems land in the common criteria, why the carve-out matters, and what evidence over a period means when prompts change weekly.

There is no shortage of AI vendor question lists. What is scarce is a view of which answers break when somebody tests them. Six claims that survive a questionnaire and not an engagement, the test that settles each, and what to ask instead.

Article 15 sets an outcome and names no test, but Annex IV asks for dated, signed test reports covering pre-determined changes. What that report has to contain, who owes it, and why the December 2027 date is the window in which the evidence gets generated.

An MCP server is an API with an unusually trusting client and an unusually powerful backend. Testing it means exposure and transport, three authorization attempts against a stated MUST NOT, the advertised tool surface, and what the server sends back — almost all of it without a model in the loop.

Forty prompt-injection payloads, none successful, risk low — and six weeks later the agent refunds the same customer twice. The unit of an agent test is the action, not the answer. Four phases, five channels, and why findings carry a rate instead of a checkmark.

“Test the customer-facing AI assistant” is one sentence, and the whole engagement will be argued from it. The seven surfaces an AI penetration test scope must name, what belongs in the rules of engagement, and what a finding must carry.

Two firms quote the same AI system and the numbers differ fourfold. Both are honest. The seven scope decisions that set the price of an AI penetration test, and the three questions that separate a scoped proposal from a priced guess.

Enterprise buyers have moved from attestation to evidence on AI. The premium does not show up as price — it shows up as sales cycle length, contract terms, and the deals you are never invited into. Four decisions for a board.

Canary data is easy to describe and easy to get wrong. A practitioner guide to designing canary strings that survive normalization and truncation, placing them without polluting production, building the detection pipeline, and knowing why a clean result usually means a broken test.

Your test report names one model. Your gateway can reach six. Routers and cascades make the execution path probabilistic — what that does to a test plan, and how to sample representative paths honestly.

Your AI inventory survives "what are we running?" and fails "how do you know that's all of it?" Six discovery signals, the blind spot in each, and how to rate an inventory's confidence honestly.

Your agent telemetry is better than it has ever been, and it still cannot certify that your controls held under attack. Three limits of the signal layer, each with a test attached.