SOC 2
SOC 2 asks you to spot and handle attacks. Here's where Kandaro helps.
SOC 2 is an independent auditor’s report on how a company protects its systems and its customers’ data, measured against the AICPA Trust Services Criteria. Customers, often in the US, ask their suppliers for one. Kandaro Deception supports the criteria on monitoring and incident handling. It does not give you a SOC 2 report on its own.
Trust Services Criteria
Which criteria Kandaro supports, and which it doesn’t.
Kandaro has a real role in the system operations criteria (CC7) and in assessing it as a vendor. For the rest you need other tools and processes, and we would rather say so.
| Criterion | What it asks | How Kandaro helps | Evidence you get |
|---|---|---|---|
| CC7.2 | Monitoring system components for anomalies that indicate malicious acts | Decoys sit among your real systems and alert on any touch: scans, logins with planted credentials, AI agents probing tools. Nobody legitimate uses a decoy, so each alert is an anomaly worth looking at. | Each decoy’s status and last check-in, every alert with its time and source, and our published detection test. |
| CC7.3 | Evaluating security events to decide whether they are incidents | Activity from one source is grouped into one incident with a fixed, rule-based severity and a plain-English explanation of what happened. | Incident severity with the rule behind it, and who assessed and closed it. |
| CC7.4 | Responding to identified security incidents | Every incident ends with a concrete next step, sent to email, Slack, your SIEM or a webhook. Your team assigns, comments on and closes it. | The activity log of who did what and when, and JSON exports of the incident timeline. |
| CC9.2 | Assessing vendor and business partner risk | Kandaro is one of your vendors. We give you what you need to assess us. | Our security page, data processing agreement, signed sensor images with a software bill of materials, and our vulnerability disclosure policy. |
| Others | Control environment, risk assessment, logical access, change management, recovery (CC7.5), availability, confidentiality, privacy | Outside what Kandaro does. | — |
What to show your auditor
For CC7.2 to CC7.4, auditors look for monitoring that runs all the time and a record that you acted on what it found. A decoy gives you both in a form that is easy to show: where the decoys are and that they are online, the alerts they raised, and what your team did with each one. Because nobody should ever touch a decoy, the record stays short and every entry matters.
You can also point to how we test our detection: every release has to raise an alert on every decoy service and stay silent when nobody is there.
Questions about how Kandaro fits your SOC 2 programme? Ask us through the contact form, or read how we secure Kandaro itself.
Using another framework too? See all frameworks Kandaro supports.
See your first explained finding today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing