Compliance assurance is facing a reckoning, and the AICPA's latest overhaul of the SOC 2 criteria will not save it.

For two decades, assurance has worked the same way. An auditor looks back over a twelve-month period, issues an opinion, and that report circulates as proof the organization can be trusted.

The problem is twofold.

First, we are looking backward in a world that moves forward at machine speed. By the time an examination concludes, the infrastructure, applications, and controls being evaluated may have changed substantially or may no longer exist. Vulnerabilities now move from disclosure to mass exploitation in about 72 hours. Artificial intelligence is accelerating both offensive capabilities and the pace of software development. Yet our assurance model still measures control effectiveness against a historical period that may have little resemblance to the environment operating today.

And when an examination identifies a control failure, the organization cannot retroactively correct it. Remediation can improve the present, but it cannot change the historical record.

Second, we extend the shelf life of that report with a SOC 2 bridge letter the company writes about itself. When a SOC 2 report no longer covers the most recent period, organizations commonly provide a bridge letter. Unlike the independent examination, that letter is typically a management statement asserting whether material changes have occurred and whether relevant controls have been maintained. It does not constitute an independent examination of the intervening period.

Consider the contradiction. We spend months independently examining the past, then ask customers to rely on an organization's own representations about what happened afterward. The longer the gap, the greater the distance between independently examined evidence and the present security posture.

We have created a system where historical evidence is treated as current assurance, and the period beyond that evidence is frequently supported by little more than a statement from the organization being assessed.

That’s a category error, not an outdated methodology.

My prediction is blunt: the era of snapshot attestation is over. The standard-setters are revising their criteria, but they are revising the wrong thing. The future belongs to continuous compliance, continuous penetration testing, and continuous automated red teaming (CART) built into every CI/CD pipeline.

The overhaul changes what gets checked, not how often

On October 28, 2026, the AICPA proposed a major update to the SOC 2 Trust Services Criteria. It adds new points of focus on AI governance, model monitoring, prompt manipulation, data poisoning, and automated decision-making. Comments are due January 15, 2027, and the criteria would apply to engagements beginning on or after December 31, 2027, with early adoption permitted.

Credit where it’s due: the content is sensible. But look at the calendar. Generative AI went mainstream in late 2022. The criteria that finally name its risks would govern audits starting at the very end of 2027, and most reports under them would not land until 2028. That’s a five-year lag on the defining technology shift of the decade.

More importantly, the proposal changes what gets checked, not how or how often. It is still an annual opinion, still a sample of evidence, still a document describing the past. Adding AI points of focus to a snapshot model is like adding a speedometer to a photograph. This is an incumbent framework trying to stay relevant in a market that’s already moving on.

Why snapshots fail no matter what the criteria say

The flaw in point-in-time attestation is structural. Better wording cannot fix it.

• Half-life of evidence. In a modern environment, a configuration screenshot is stale within days. An access review is out of date the next time someone joins or leaves. Evidence collected for an audit describes a system that no longer exists.

• Sampling in a world of millions of changes. Auditors test a handful of change tickets out of thousands of deployments. The one change that opens a public storage bucket is almost never in the sample.

• Incentives point at the test, not the threat. When the audit is the finish line, teams prepare for it the way students cram for an exam. Controls look best in the weeks before fieldwork and drift for the rest of the year.

• Cheap attestations have hollowed out trust. The incentives point the wrong way: auditors who reliably pass clients get referrals, and auditors who fail them don't. Compliance automation has sharpened that question, and sophisticated buyers have noticed. Many now pile their own questionnaires on top, which tells you the report alone no longer does its job.

A once-a-year opinion cannot describe a system that changes every hour.

Continuous compliance replaces the annual report

Continuous compliance means control status is monitored and evidenced without interruption, so it reads as a live signal instead of an annual document.

In a continuous compliance model, controls are defined as code and enforced in the platform. Every change is checked against policy before it ships. Telemetry from cloud accounts, identity providers, endpoints, and pipelines feeds a continuous control-monitoring layer that knows, at any moment, which controls are working and which have drifted. Assurance stops being something you prepare for and becomes something your systems emit.

For buyers, that changes the question. Instead of "Do you have a clean report from last year?" the question becomes "Can you show me your control status right now, and how fast you fix drift?" Trust portals with live control status, shared telemetry, and contractual commitments on remediation time are early versions of this shift. (Ours is here.)

In this world, a human assessor still has a role: validating that the monitoring itself is sound, that the right things are being measured, and that the data cannot be gamed. But the assessor reviews a continuous system. They do not reconstruct a year from a folder of screenshots.

Pentesting has the same disease

The annual penetration test is the offensive twin of the annual audit. A team spends two weeks on a scoped slice of the environment, writes a report, and leaves, and by the time the remediation tickets close the application has shipped hundreds of releases the testers never saw. The report then plays the same role as the audit report: a document attached to a vendor questionnaire and filed. It proves someone looked once, which is not the same as proving the system holds up today. (I made the longer version of this case in why the annual pentest is dead.)

Pentesting must become ongoing. That means:

• Testing triggered by change, not by the calendar. A new API endpoint, a new authentication flow, or a new cloud account should trigger targeted testing within days, not wait for next year's engagement.

• Human experts focused on depth. Automation covers breadth and regression, and it has real blind spots around deployment context. Skilled testers spend their time on business-logic flaws, chained attacks, and novel techniques that machines miss.

• Findings that flow into engineering, as tickets in the same backlog as feature work, with retesting built in, rather than a PDF that sits in a shared drive.

Pentest-as-a-service platforms and continuous testing programs already exist. I think what’s coming is that buyers will refuse to accept anything else.

CART: the need-to-have in every CI/CD pipeline

Continuous automated red teaming (CART) takes the logic one step further. Instead of testing an application occasionally, it runs authorized, automated attack simulations continuously. It maps the attack surface, finds exploitable weaknesses, chains them into realistic attack paths, and confirms whether fixes actually work.

Today, most organizations treat CART as an advanced capability for mature security teams. That will not last. Within a few years, I expect CART to be as standard in a CI/CD pipeline as unit tests and dependency scanning are now. Here is why:

• Release velocity demands it. If you deploy fifty times a day, the only testing that keeps up is testing that runs on every deployment.

• AI changes the attacker side of the equation. Adversaries already use automation and AI to probe at scale, and manual testing once a year cannot keep pace.

• AI changes the attack surface, too. Prompt injection, data poisoning, and agent misuse cannot be validated by a policy document. They need adversarial testing against the live model and its tools, repeated with every model or prompt change.

• It produces the evidence assurance actually needs. A record of continuous attack attempts and their outcomes is far stronger proof of resilience than an auditor's sample of change tickets.

In practice, this looks like a pipeline stage that deploys to a staging environment, runs a targeted attack suite against what changed, and blocks the release if a critical path opens up. Results feed a live risk view that security, engineering, and eventually customers can see.

Predictions

1. Enterprise buyers will ask for live evidence over annual reports. Procurement will increasingly ask for continuous control status and recent attack-simulation results, and will treat a static report as a minimum, not a decision-maker.

2. Annual pentests will become a compliance artifact, not a security practice. Serious programs will run continuous testing and keep the yearly engagement only because a contract requires it.

3. CART will become a default pipeline stage, first in regulated industries and AI-heavy products, then everywhere.

4. Attestation will survive by becoming continuous. The frameworks and audit firms that thrive will be the ones that rebuild around live data and ongoing opinions. Those that only revise their criteria will be left issuing reports nobody reads.

What to do now

• Treat your next audit as a byproduct, not a project. Invest in automated control monitoring and evidence collection first.

• Move pentesting from an annual purchase to an ongoing program tied to your release process.

• Pilot CART on your highest-risk application or AI feature, wired into its CI/CD pipeline.

• Start offering customers live trust signals instead of waiting for them to send another questionnaire.

The snapshot era is behind us

The AICPA's overhaul is a reasonable update to a model whose time has passed. Updating the criteria while keeping the annual snapshot is like printing a better timetable for a train that has already left the station. Security is now continuous, attacks are continuous, and software change is continuous. Assurance has to be continuous too. The organizations that accept that now will set the standard everyone else is measured against.

Aptible enforces these controls in the platform and evidences them continuously. Start with compliance and security.

Sources

• AICPA Proposes Update of SOC 2 Trust Services Criteria, AICPA & CIMA, October 28, 2026

• Proposed 2027 SOC 2 Trust Services Criteria and Description Criteria (exposure draft), AICPA & CIMA

• Continuous Automated Red Teaming (CART): A Complete Guide, Site24x7