Learn

What the standards actually say.

Compliance guidance is mostly written by people selling the checkbox. These pages quote the control text verbatim, publish the real price bands, and give the honest answer even when it costs us the pitch.

SOC 2

• 01 SOC 2 compliance: what it is, what it costs, how long it takes → There is no such thing as SOC 2 certified. What the report actually is, who is allowed to sign it, why you probably need one category and not five, and the real 2026 cost stack.
• 02 SOC 2 audit cost in 2026: every line item, priced → The three line items vendors blur, what actually sets the CPA's floor, why the published $30K to $50K ranges are written by people selling platforms, and our all-in $6,088.
• 03 Does SOC 2 require a penetration test? → No criterion mandates one. What the AICPA actually says, why auditors expect a test anyway, real 2026 price bands, and the observation-window timing rule.
• 04 Which platforms include a penetration test with SOC 2 compliance? → Almost none. Why Vanta and Drata refer the test to a partner, the one line that can never be bundled no matter who is selling, and what each route costs.

ISO 27001

• 05 Does ISO 27001 require penetration testing? → No control names it. Why A.8.8 and A.8.29 make a test the practical answer anyway, the scope mismatch that becomes a nonconformity, and what to hand the auditor.

Penetration testing

• 06 How much does penetration testing cost? → $5,000 to $30,000 for a web app, and under $4,000 is a scan. The 2026 bands by engagement type, the day-rate math behind every quote, and our public price list.
• 07 Which frameworks require a third-party penetration test? → Three do: FedRAMP, CSA STAR and DORA. PCI and NYDFS accept an internal tester, SOC 2 and ISO 27001 require no test at all. The control text for each, quoted.

PCI DSS

• 08 PCI DSS penetration testing requirements → The framework that mandates a pentest in normative text. Requirement 11.4 clause by clause, the retest everyone forgets to price, and why it does not need a QSA.

Security research

• 09 CVE-2026-73649: a critical RCE we found in velocity.js → CVSS 9.8, CVE-2026-73649 (GHSA-7gfh-x38p-prh3), fixed in 2.1.7. The property-read chain to the Function constructor, why the prior prototype-pollution patch missed it, and how to fix it.
• 10 A disabled key-size check we reported in Tor's arti → A misplaced ! disabled an RSA key-size check in Tor's arti. How if !x == y compiles in Rust, why it slipped past clippy and the tests, and the one-line fix Tor merged.
• 11 The Function constructor escapes safe eval in JSONPath-Plus → A property read returned the Function constructor in a library pulled 12M times a week, so obj.constructor gave RCE. The guard gap, the one-clause fix, and the CVE chain.
• 12 A cookie-leak bug we reported in tough-cookie → A URL-parsing differential leaked victim.com cookies to attacker hosts, in a library pulled 480M times a month. The decodeURI root cause, the fix, and a note on crediting researchers.