SOC 2 News and Updates for 2026

SOC 2 plays an important role in how businesses demonstrate security controls and evaluate the companies they trust with sensitive information. Changes in audit guidance, reporting practices, and customer expectations affect both organizations pursuing reports and those relying on them.

Headlines about disputed audit reports, AI-related guidance, and increased auditor scrutiny raise questions about how SOC 2 assurance is delivered and verified.

This article covers the latest SOC 2 news in 2026, including guidance updates, audit integrity concerns, regulatory proposals, and developments in compliance technology.

We examine what these developments mean for businesses, auditors, and customers, with monthly updates that make the important changes easier to follow.

SOC 2 News and Updates for January 2026

1. AWS Releases SOC Reports Covering 185 Services

Announcement Date: January 20, 2026

Amazon Web Services announced the availability of its Fall 2025 SOC 1, SOC 2, and SOC 3 reports, covering 185 services. The release gives customers updated independent assurance information for reviewing AWS controls and supporting their compliance programs.

The reports cover the 12-month period from October 1, 2024, through September 30, 2025. Although the report package carries the Fall 2025 name, AWS announced its availability in January 2026.

Customers can download the SOC 1 and SOC 2 reports through AWS Artifact by signing into the AWS Management Console. The SOC 3 report is available through the AWS SOC Compliance page, providing a publicly accessible assurance resource.

For organizations using AWS, the release provides updated evidence for cloud vendor assessments and audit preparation. Teams reviewing the SOC 2 report should check its examination period and confirm that the AWS services supporting their systems fall within its scope.

Source: AWS Security Blog.

2. FortifyData Introduces AI Review Of Vendor SOC 2 Reports

Announcement Date: January 6, 2026

FortifyData announced new features for its third-party risk management platform, including an AI Auditor that analyzes vendor SOC 2 reports. The company introduced the tool as a way to help security teams review reports alongside other vendor assessment documents.

Teams can upload a SOC 2 report and compare its contents against selected security frameworks. FortifyData says the tool highlights potential control gaps and provides page-specific citations so reviewers can check findings against the original report.

The AI Auditor had a limited release in late 2025. FortifyData’s January announcement expanded its presentation and previewed workflow features intended to request missing evidence, follow up with vendors, and track assessment tasks. The company described those workflow features as upcoming.

The development reflects growing interest in speeding up vendor reviews as organizations collect more SOC 2 reports. Buyers still need to examine each report’s scope, examination period, exceptions, and complementary user entity controls before relying on it for a risk decision. A SOC 2 report example helps readers identify these sections and understand how the findings fit together.

Source: FortifyData announcement.

3. Ricoh CloudStream Completes SOC 2 Type 2 Examination

Announcement Date: January 23, 2026

Ricoh announced that CloudStream, its cloud platform for managing printers, scanners, and other devices, completed a SOC 2 Type 2 examination. The examination focused on the Security Trust Services Category.

CloudStream supports print, scan, and device management across equipment from multiple vendors. Ricoh said the examination assessed whether the platform’s security controls were suitably designed and operated consistently during the period covered by the report. The company did not specify that period in its announcement.

The result gives customers another document to review when assessing CloudStream for use in their organizations. Ricoh makes the SOC 2 report available upon request, allowing prospective customers to examine its scope, auditor opinion, and any exceptions before making a vendor risk decision.

The announcement concerns CloudStream specifically. It should not be read as assurance covering every Ricoh product or all five Trust Services Categories.

Source: Ricoh announcement.

SOC 2 News and Updates for February 2026

1. AICPA Proposes Updates To Attestation Standards Used In SOC 2 Examinations

Announcement Date: February 26, 2026

The AICPA’s Auditing Standards Board released an exposure draft proposing changes to its attestation standards. The proposal updates the baseline requirements for examination and review engagements and introduces separate provisions for reporting on sustainability information.

SOC 2 examinations are performed under the AICPA’s attestation standards, so changes to the baseline requirements could affect how service auditors plan, perform, and report on those engagements. The proposal does not change the SOC 2 Trust Services Criteria.

The board said the revisions respond to the growing use of attestation services for areas including cybersecurity, digital assets, and governance. The draft was open for public comment through June 30, 2026, with further deliberation required before any changes could be adopted.

Organizations preparing for a SOC 2 examination can continue using the current requirements. The February document was a proposal, and its release did not create a new SOC 2 obligation.

Sources: Journal of Accountancy announcement; AICPA proposal overview.

2. AICPA Flags Partner Involvement In SOC Engagements

Announcement Date: February 16, 2026

The AICPA’s February Reviewer Alert raised concerns about engagement partners who were not sufficiently involved throughout SOC examinations. The alert addressed how peer reviewers should assess partner involvement in these engagements, including SOC 2 examinations.

An engagement partner is responsible for the quality of the examination and the conclusions in the final report. The AICPA highlighted the need for involvement from planning and risk assessment through fieldwork and report issuance, rather than a review only at the end of the engagement.

The alert followed peer review feedback identifying cases of insufficient partner involvement. It did not introduce a new SOC 2 requirement or conclude that every report from the firms involved was unreliable. It drew attention to how auditors supervise the work behind a report and document their decisions.

For organizations obtaining or reviewing SOC 2 reports, the development reinforces the importance of the independent auditor’s work, beyond the existence of a completed report.

Source: AICPA February 2026 Reviewer Alert.

3. Vanta Adds Auditor Request Lists To Its SOC 2 Audit Workflow

Announcement Date: February 15, 2026

Vanta introduced information request lists in public preview, allowing customers to bring an auditor’s evidence requests into its compliance platform. The feature was available to customers on Professional plans and above.

Teams can map requests to existing controls and evidence, assign an owner to each request, and review materials internally before sharing them with the auditor. Vanta said customers can use the workflow whether their auditor works inside Vanta or uses a separate system.

The update applies to audit work that can include SOC 2 examinations. It gives organizations a way to track what the auditor requested and control which evidence they provide. The auditor remains responsible for evaluating that evidence and reaching an independent conclusion.

Vanta introduced a separate feature for importing publicly available documents from external vendor trust centers into third-party risk assessments. That feature addresses vendor reviews rather than the examination of a customer’s own controls.

Source: Vanta February 2026 product update.

4. SOC 2 Auditors Raise Concerns About Rushed Examinations

Publication Date: February 1, 2026

A Journal of Accountancy investigation described concerns among SOC practitioners about companies promising fast, inexpensive SOC 2 reports. The practitioners said high-volume business models could put pressure on CPA firms to shorten examinations or use procedures that do not reflect each client’s risks.

Auditors interviewed for the article pointed to reports that appeared heavily standardized and questioned whether a small number of examiners could properly oversee a large volume of engagements. They raised concerns about auditor independence when a referral platform sets unrealistic deadlines or promises customers a favorable outcome.

The article did not find that every accelerated SOC 2 examination was deficient. It identified a risk for buyers who treat possession of a report as sufficient evidence without examining its scope, testing, exceptions, and auditor.

The concerns surfaced before the Delve allegations became public in March. They provide context for the scrutiny of SOC 2 report quality that followed later in 2026.

Source: Journal of Accountancy investigation.

SOC 2 News and Updates for March 2026

1. Delve Faces Allegations Over SOC 2 Reports And Audit Evidence

Publication Date: March 19, 2026

An anonymous investigator using the name DeepDelver accused compliance platform Delve of supplying fabricated evidence and preparing SOC 2 audit conclusions before independent testing was complete. The investigation drew on a leaked collection of customer audit materials.

The investigator’s analysis found nearly identical language in 493 of 494 SOC 2 reports examined. It raised questions about whether the reports reflected each organization’s controls and whether the audit firms performed sufficient independent work. Those findings are allegations, not a determination that every report was invalid.

Delve denied producing fake evidence or issuing SOC 2 reports. The company said it provides templates and audit preparation tools, while licensed, independent auditors test controls and issue final opinions. On March 24, Delve offered customers complimentary re-audits and greater visibility into auditor communications.

The dispute drew attention to what a SOC 2 buyer can verify in a report: its scope, tested controls, examination period, exceptions, and the identity of the firm that signed it.

Sources: DeepDelver investigation; Delve response; Delve customer measures.

2. AWS European Sovereign Cloud Releases First SOC 2 Report Covering 69 Services

Announcement Date: March 10, 2026

AWS announced the availability of its first SOC 2 Type 1 report for the AWS European Sovereign Cloud. The release included a C5 Type 1 report, with both attestations covering 69 services operating within the European cloud environment.

The SOC 2 report addresses security, availability, and confidentiality. It includes controls mapped to AWS’s Sovereign Reference Framework, which covers governance independence, operational control, data residency, and technical isolation.

AWS said the examination assessed the design and implementation of controls supporting EU corporate structures, operations by EU-resident personnel, and residency requirements for customer content and metadata. The European Sovereign Cloud launched in January 2026 as an environment physically and logically separate from other AWS Regions.

Customers can obtain the reports through AWS Artifact using their European Sovereign Cloud accounts. As a Type 1 examination, the SOC 2 report evaluates controls at a specific point in time. A Type 2 examination would evaluate their operating effectiveness over a defined period.

Source: AWS announcement.

3. Thoropass Survey Finds AI Adoption Outpacing Security And Compliance Controls

Announcement Date: March 25, 2026

Thoropass released its 2026 State of Audit and Compliance Report, drawing on responses from 536 security and compliance leaders. The survey found that 69% believed their organization’s adoption of AI tools was moving faster than its ability to maintain security and compliance controls.

Audit evidence remained a recurring problem. 53% identified collecting evidence across multiple tools as an audit bottleneck, while 91% said they had to resubmit evidence at least sometimes because of miscommunication or changing auditor expectations.

AI-related data exposure or misuse was the leading breach concern for 55% of respondents. These figures reflect participants’ concerns and experiences across compliance programs; they do not measure SOC 2 audit failure rates or establish how many organizations suffered an AI-related breach.

For teams preparing for SOC 2 examinations, the findings point to practical preparation needs: identifying where AI tools handle company data, assigning responsibility for relevant controls, and keeping supporting evidence organized throughout the examination period. For more data on audit readiness, compliance workload, and automation, explore our SOC 2 statistics.

Source: Thoropass 2026 State of Audit and Compliance Report.

SOC 2 News and Updates for April 2026

1. Delve And Y Combinator Part Ways Amid SOC 2 Audit Allegations

Announcement Date: April 4, 2026

Compliance startup Delve and Y Combinator parted ways amid allegations involving fabricated compliance evidence and questionable SOC 2 audit practices. Delve COO Selin Kocalar confirmed the separation, and the company’s profile was removed from Y Combinator’s startup directory.

The development followed anonymous claims that surfaced in March, questioning whether customer reports had undergone proper independent examinations. Those allegations included prewritten audit conclusions and concerns about the independence of firms conducting the examinations.

Delve disputed the claims. Its leadership said stolen information and selectively presented screenshots had been used in a coordinated campaign against the company. Delve said it was introducing a new auditor network, offering free re-audits and penetration tests, and improving transparency in audit communications.

The separation marked a business consequence as the allegations drew scrutiny from customers and investors. The departure itself did not establish whether the alleged misconduct occurred, and Delve continued to challenge the accusations.

Source: The Economic Times.

2. AICPA Warns Of Independence Risks In SOC 2 Platform Partnerships

Publication Date: April 6, 2026

AICPA Professional Ethics Division staff issued guidance on ethical risks in business arrangements between SOC 2 auditors and compliance software providers. The guidance addresses relationships that give technology vendors influence over audit fees, deadlines, evidence access, or professional judgment.

Examples include bundled services where a platform sets examination fees, referral arrangements that create financial dependence, and deadlines that disregard the auditor’s evidence requirements. Contract terms that restrict communication of deficiencies can create further conflicts.

The guidance addresses marketing practices, including guaranteed clean audit results and claims that auditors are “AICPA-approved.” Auditors remain responsible for promotional activities tied to their services, even when a software provider handles the marketing.

AICPA staff advised auditors to evaluate threats, apply appropriate safeguards, and document their conclusions where required. If an arrangement prevents compliance with professional requirements, the auditor should decline or discontinue it. The guidance applies existing ethics and attestation requirements to these relationships.

Source: Journal of Accountancy.

3. Secureframe Launches User Access Reviews To Support Audit Evidence Collection

Announcement Date: April 7, 2026

Secureframe launched User Access Reviews within its compliance platform, giving organizations a centralized workflow for reviewing employee access to business systems. The feature supports assigning reviewers, evaluating permissions, recording decisions, and tracking remediation.

Teams can import user data through integrations or CSV uploads and organize reviews by application. Reviewers can decide whether to maintain, modify, or revoke access, with follow-up tasks available through connected ticketing tools.

The launch addresses a recurring compliance challenge: assembling evidence from spreadsheets, email exchanges, and manual follow-ups. Secureframe’s workflow captures reviewer identities, access decisions, and remediation actions, with exportable summaries that teams can share during audits.

Organizations can schedule recurring reviews and use automated reminders to track completion. For businesses preparing for SOC 2 examinations, the feature provides a way to retain evidence of access oversight within the same platform used to manage controls and policies. Its usefulness depends on teams reviewing permissions accurately and completing the resulting remediation.

Source: Secureframe announcement.

4. Chainlink Announces Deloitte SOC 2 Type 2 Examination For CCIP And Data Feeds

Announcement Date: April 21, 2026

Chainlink announced that Deloitte & Touche LLP completed a SOC 2 Type 2 examination covering its Cross-Chain Interoperability Protocol, known as CCIP, and Data Feeds. The examination adds to Chainlink’s existing SOC 2 Type 1 and ISO/IEC 27001:2022 credentials.

CCIP supports communication and asset transfers between blockchains, while Data Feeds supply external information used by blockchain applications. These services underpin use cases where institutions need to assess the controls of infrastructure providers before deployment.

A SOC 2 Type 2 examination evaluates the design and operating effectiveness of controls over a defined period. The distinction between Type 1 and Type 2 matters when reviewing a provider’s assurance: Type 1 addresses a specified date, while Type 2 includes testing of control operation over time.

The announcement expands the assurance materials available to organizations evaluating Chainlink. Customers should review the report’s scope, examination period, test results, and applicable responsibilities to determine its relevance to their deployment. The examination does not guarantee the security of every application using Chainlink services.

Source: Chainlink ecosystem announcement and Chainlink’s CCIP overview.

SOC 2 News and Updates for May 2026

1. AICPA Strengthens Peer Review Scrutiny Of SOC 2 Audit Quality

Publication Date: May 14, 2026

The AICPA outlined steps for peer reviewers to address quality risks in SOC 2 examinations, including concerns about high-volume audit practices using third-party compliance platforms. The guidance emphasizes whether engagements reflect each customer’s risks and operating environment.

When elevated risks emerge, reviewers may select approximately five engagements across different partners and compare reports, risk assessments, sample sizes, and testing procedures. Identical work across clients can indicate that auditors have failed to apply the professional judgment required by applicable standards.

Engagements that materially fail to meet professional standards may be classified as nonconforming. Such findings can contribute to deficiencies in a firm’s peer review and require follow-up measures, including changes to quality management or external reviews of completed engagements.

The AICPA planned a structured monitoring and outreach process beginning June 1. Staff would identify upcoming reviews of SOC 2 practices, contact review team captains, and provide resources to support engagement selection and evaluation.

Source: Journal of Accountancy.

2. Coalfire Launches Audit AI To Support Compliance Reviews And Evidence Collection

Announcement Date: May 5, 2026

Coalfire announced Audit AI, a new capability within its Compliance Essentials platform designed to support policy reviews and evidence collection. The launch expands the company’s use of artificial intelligence in compliance preparation and assessment workflows.

The tools help teams review policies and procedures for gaps and collect evidence from connected business systems. Coalfire identifies Jira, GitHub, and Microsoft 365 among the systems supported through compatible integrations.

Coalfire said Audit AI draws on insights from more than 1 million assessment hours. Its accompanying transparency materials describe a connection that allows AI assistants to work with live compliance data, identify outstanding evidence, and generate analytical reports.

For organizations preparing for SOC 2 examinations, these capabilities address the work of organizing evidence and checking documentation before assessment. The launch brings AI further into audit preparation, while the sufficiency of evidence, testing decisions, and examination conclusions remain matters for the auditor’s professional judgment.

Source: Coalfire announcement.

3. Vanta Introduces AI-Guided Onboarding For SOC 2 Preparation

Release Window: Week Of May 24, 2026

Vanta introduced an AI-guided onboarding experience for startups using its SOC 2 Guide. The update helps users begin their compliance program through a conversational workflow within the Vanta Agent, with availability listed for Essentials and Plus packages.

The agent generates a tailored compliance plan, confirms the company’s profile, and recommends integrations to connect. Users can ask questions throughout the process without leaving the agent experience, bringing initial setup and guidance into one workflow.

The release focuses on the early stages of SOC 2 preparation, when teams need to establish company information and connect systems that support compliance activities. Its recommendations give users a starting point for organizing the work required before an examination.

Vanta included the feature in its release notes for the week of May 24 without specifying an individual launch date. The update supports readiness activities; organizations remain responsible for implementing controls, and an independent auditor evaluates those controls during the SOC 2 examination.

Source: Vanta product updates.

4. Canvas Cyberattack Disrupts Schools Following SOC 2 Type II Renewal

Incident Date: May 7, 2026

Instructure’s Canvas learning platform suffered further unauthorized access on May 7, disrupting schools and universities during final exams. The company said the attacker exploited a second Canvas vulnerability after an earlier intrusion disclosed at the beginning of May.

The earlier incident involved information including names, email addresses, student identification numbers, and messages between Canvas users. Instructure placed the platform into maintenance mode during the May 7 response, interrupting access to coursework and other learning resources.

The incident followed Instructure’s December 2025 announcement that it had renewed its SOC 2 Type II attestation alongside other security credentials. That history makes the breach relevant to institutions relying on assurance reports when evaluating technology vendors.

The attack does not, by itself, establish that the SOC 2 examination was deficient. It highlights why vendor assessments need to consider current incident disclosures, remediation progress, and operational resilience alongside the controls and period covered by an assurance report.

Sources: Instructure incident updates, Texas A&M System incident timeline, and Instructure’s security assurance announcement.

SOC 2 News and Updates for June 2026

1. Spreedly Sues Delve Over Compliance Services And Disputed Refund

Filing Date: June 3, 2026

Payment platform Spreedly filed a lawsuit against Delve Technologies in North Carolina, alleging that the compliance company breached their services agreement. Spreedly said it had paid approximately $267,000 upfront for security and compliance management services under an agreement effective December 31, 2025.

According to the complaint, Spreedly later received third-party allegations that Delve had fabricated compliance documents and that auditors involved in its services were not independent. Spreedly further alleged that Delve notified it of a breach affecting some of Delve’s storage systems.

Spreedly said its investigation found no exposure of its or its clients’ sensitive data from that breach. It nevertheless terminated the agreement and demanded a refund, arguing that the events undermined its confidence in the services it had purchased. The complaint alleges that Delve initially promised a refund but had not paid it.

The filing turns the broader dispute over Delve’s compliance practices into a customer contract case. Spreedly’s claims have not been established by a court, and the complaint does not show that Spreedly received an invalid SOC 2 report.

Source: Spreedly’s complaint, filed in Durham County Superior Court.

2. AWS Makes SOC 1 And SOC 2 Reports Available In Machine-Readable Format

Announcement Date: June 18, 2026

Amazon Web Services released its Spring 2026 SOC 1 and SOC 2 report package in Open Security Controls Assessment Language, or OSCAL, alongside the existing PDF versions. Customers can download the new package through AWS Artifact.

The reports cover 188 AWS services for the period from April 1, 2025, through March 31, 2026. OSCAL provides structured, machine-readable security information that organizations can use in compliance and vendor assessment workflows.

The format change may help customers process report information without relying entirely on manual PDF review. AWS made the OSCAL files available as a separate package, allowing teams to decide whether to use the structured data, the PDF reports, or both.

For organizations using AWS in a SOC 2 examination, the reports can support their review of the cloud provider’s controls. Customers still need to check which services are within scope and meet the responsibilities that apply to their own systems. The OSCAL release changes how report information can be used; it does not expand the examination’s scope.

Source: AWS Security Blog.

3. Drata Introduces AI Agent Governance As Security Reviews Expand

Announcement Date: June 10, 2026

Drata introduced an AI Agent Governance capability in early access, extending its compliance platform to help organizations identify and oversee AI agents operating across business systems. The company said the product is designed to map each agent to an owner, identity, permissions, and operating scope.

Drata said AI-specific questions in security reviews had increased by more than 30% over the preceding nine months across its platform. Those questions increasingly ask which agents are running, what they can access, and whether their actions can be monitored and explained.

The proposed controls include discovering agents, evaluating their actions against policies, flagging changes in behavior, and retaining activity records. Drata said early access was available to customers in financial services, healthcare, and software.

The development reflects a new area of vendor scrutiny for organizations using AI agents. Existing SOC 2 examinations can assess relevant access and monitoring controls within their stated scope, but Drata’s product announcement did not introduce a new SOC 2 criterion or create an AI-specific SOC 2 report.

Source: Drata announcement.

SOC 2 News and Updates for July 2026

1. Anthropic Finds Claude Accessed Three Organizations During Security Tests

Disclosure Date: July 30, 2026

Anthropic disclosed three incidents in which Claude models gained unauthorized access to real organizations during cybersecurity evaluations. The company found them while reviewing 141,006 test runs after the separate Hugging Face incident prompted a broader check.

The tests were meant to take place in simulated environments run with evaluation partner Irregular. A configuration mistake left an internet path open, allowing the models to reach real systems while pursuing their assigned security challenges. In one incident, a model accessed a database containing several hundred rows of production data.

Anthropic stopped the evaluations on July 23, identified the three incidents the following day, and notified the affected organizations on July 27. It said the testing infrastructure was separate from its sensitive internal systems and customer data. The company plans stronger monitoring and assurance work with evaluation vendors.

Anthropic’s trust center lists a SOC 2 Type 2 report. The disclosure makes testing environments and third-party oversight important questions for customers reviewing its security practices. Anthropic has not said whether the affected evaluation environment fell within that report’s scope, so the incidents should not be presented as SOC 2 audit findings.

Sources: Anthropic incident disclosure; Anthropic Trust Center.

2. FedRAMP Opens Class A Path For Providers With SOC 2 Type II Reports

Announcement Date: July 30, 2026

FedRAMP announced that cloud providers with a completed SOC 2 Type II report could use it to support an application for its new Class A certification. The application pipeline was scheduled to open on August 3 as part of the FedRAMP 20x rollout.

Class A is the entry-level certification tier and replaces the former FedRAMP Ready route for new applicants. Providers could begin with either a SOC 2 Type II report or a completed FedRAMP Readiness Assessment Report. FedRAMP said a provider with a federal customer would have 12 months to begin moving toward Class B or a higher tier.

The change gives commercially audited cloud companies a potential starting point for entering the federal market. A SOC 2 Type II report remains evidence for the application, however; holding one does not automatically confer FedRAMP certification.

Providers considering this path need to confirm that their report covers the cloud service offering they intend to submit and prepare the additional material FedRAMP requires. The news makes the scope and quality of an existing SOC 2 report more consequential beyond commercial procurement.

Source: FedRAMP July 30 announcement.

3. GAO Questions Wording In Proposed Attestation Standards Affecting SOC 2

Public Release Date: July 2, 2026

The U.S. Government Accountability Office made public its comments on the AICPA Auditing Standards Board’s proposed revisions to attestation standards. The proposals include changes to baseline examination requirements that could eventually affect how CPA firms conduct SOC 2 engagements.

GAO supported updating the standards but raised concerns about wording in the baseline sections. It said the proposals used inconsistent language about when a practitioner may withdraw from an engagement. GAO recommended clearer, consistent wording and sought changes to where certain definitions appear.

The letter addressed broader attestation proposals, including sustainability assurance; it did not identify a faulty SOC 2 report or announce a new SOC 2 requirement. The AICPA’s comment period had closed on June 30, leaving the board to consider responses before issuing any final standard.

For SOC 2 readers, the development is about the rules auditors may eventually work under, rather than an immediate change to the Trust Services Criteria. Companies planning an examination can continue using the current standards while monitoring the AICPA’s decisions.

Sources: GAO comment letter and release date; AICPA summary of comments.

SOC 2 News and Updates for August 2026

1. Researcher Reports 181,874 Exposed Meeting Records At tl;dv

Disclosure Date: August 4, 2026

Security researcher BobDaHacker disclosed an access control vulnerability in AI meeting assistant tl;dv that reportedly exposed 181,874 meeting records belonging to 84,312 users. According to the researcher, signed-in users could retrieve other customers’ meeting metadata because a database collection lacked restrictions separating customer accounts.

The exposed information included meeting creators’ email addresses, conference IDs, timestamps, and recording status. The researcher said these details helped them join two live calls. Recordings and transcripts remained private by default; the disclosure did not establish that all 181,874 recordings were accessible.

BobDaHacker said they first reported the issue on January 28 and continued following up through July. Dark Reading reported that it received no response from tl;dv before publishing its August 4 coverage and that the vulnerability remained active at publication.

tl;dv’s security page advertises a SOC 2 Type II report. For organizations assessing the service, the disclosure raises specific questions about customer data separation and vulnerability response. The public findings do not establish what the SOC 2 examination covered or whether its auditor identified related exceptions.

2. SOC 2 Benchmark Finds Exceptions In 53 Of 75 Examinations

Release Date: August 2026

Lazarus Alliance released a SOC 2 audit benchmark showing that 53 of 75 examinations contained at least one exception. The analysis covers completed Type 1 and Type 2 examinations conducted by the firm between January 2025 and June 2026, including first-time audits and renewals.

Access control and user provisioning produced the most frequent exceptions, appearing in 51% of examinations. Findings included incomplete employee access records, delayed account removal, and insufficient evidence of periodic access reviews. Change management followed at 41%, with logging, monitoring, and alerting at 37%.

Evidence preparation presented another challenge. 66 of 75 examinations required additional evidence or clarification. These findings give organizations preparing for SOC 2 a practical reason to review whether their records demonstrate control operation throughout the relevant examination period. Use our SOC 2 controls list to connect relevant controls with responsible owners, evidence sources, and review schedules.

The figures reflect one firm’s examination sample and should not be treated as industry-wide failure rates. An exception does not automatically mean an adverse or qualified opinion. For readers reviewing SOC 2 reports, the nature and significance of each exception matter more than the count alone.

Source: Lazarus Alliance’s 2026 SOC 2 Audit Benchmark Report.

3. AICPA Clarifies Engagement Team Definition For Attest Practitioners

Announcement Date: August 17, 2026

The AICPA’s Professional Ethics Executive Committee adopted a revised definition of “attest engagement team,” clarifying which participants fall within the term when firms apply independence and other professional ethics requirements. The clarification is relevant to CPA firms performing SOC 2 examinations.

The definition explicitly excludes internal auditors, auditor’s external specialists, practitioner’s external specialists, referred-to auditors, and referred-to practitioners. These exclusions clarify team membership within the ethics code; they do not remove requirements that may apply to those participants under other professional standards.

The revision takes effect for engagements beginning on or after December 15, 2026, with early implementation permitted. AICPA says the wording supports more consistent application and does not change how the existing definition applies.

For SOC 2 audit firms, the practical work includes reviewing independence policies, training materials, and engagement guidance against the clarified definition. Service organizations should understand this as an update to the professional framework governing their examiners. It does not introduce new SOC 2 Trust Services Criteria or additional security controls.

Sources: AICPA revised definition; Journal of Accountancy coverage.

SOC 2 News and Updates for September 2026

1. AICPA Releases Guidance On AI In SOC 2 Examinations

Release Date: September 11, 2026

AICPA released Technical Q&A Section 9561 addressing how a service organization’s use of artificial intelligence affects SOC 1 and SOC 2 examinations. The guidance gives practitioners a dedicated resource for evaluating AI use within these assurance engagements.

For SOC 2, the questions and answers address examinations performed under AT-C section 205, which governs assertion-based examination engagements. The resource separates questions applicable to SOC 1, questions applicable to SOC 2, and those relevant to both.

The release concerns the effect of AI on examination work. It should not be presented as a new SOC 2 certification for AI products or a separate set of AI-specific Trust Services Criteria. Organizations need to distinguish guidance on applying the existing framework from changes to the criteria themselves.

For businesses using AI within services covered by a SOC 2 report, the guidance provides a timely basis for discussions with their auditor. Those discussions can address how AI use affects the system being examined and the information needed to support the engagement. Reviewing existing SOC 2 requirements can help teams organize their scope, policies, controls, and evidence before those discussions.

Sources: AICPA Technical Q&A Section 9561; Deloitte’s release summary.

2. SEC Seeks Comments On SOC 2 Assessments For Transfer Agents

Federal Register Date: September 4, 2026

The U.S. Securities and Exchange Commission asked whether transfer agents should obtain independent cybersecurity and operational risk assessments, explicitly naming SOC 2 reports as an example. The question appears in its proposed modernization of transfer-agent rules, which entered the Federal Register on September 4.

The SEC asks how frequently such assessments should occur and whether reports should be filed with the Commission or made available to the appropriate regulatory agency’s staff. These questions address both the potential requirement for independent assurance and regulators’ access to the resulting reports.

The broader proposal addresses safeguarding securities and funds, operational resilience, and cybersecurity risk management. Within that proposal, the SOC 2 question gives stakeholders an opportunity to explain whether existing attestation reports would provide useful assurance about transfer agents’ controls.

The request does not establish a mandatory SOC 2 requirement. Comments are due November 3, 2026. For transfer agents and their auditors, the consultation creates a specific opportunity to address assessment scope, frequency, reporting access, and the practical implications of a potential requirement.

Source: SEC transfer-agent proposal, Federal Register, question 112.

3. ProcessUnity Introduces AI Agent For SOC 2 Report Reviews

Announcement Date: September 1, 2026

ProcessUnity introduced a SOC 2 Analyzer as part of its new AI Agents for Third-Party Risk Management suite. According to the company, the agent reviews SOC 2 reports and identifies examination scope, exceptions, and complementary user entity controls.

These details help customers assess what a vendor’s report covers and which responsibilities remain with their own organization. Complementary user entity controls describe controls the service organization expects its customers to implement, making them a practical part of reviewing and using a SOC 2 report.

The analyzer forms part of a broader release covering vendor intake, due diligence, and monitoring. ProcessUnity says the agents automate manual tasks while routing decisions requiring judgment to human specialists. The SOC 2 feature specifically targets the work involved in extracting relevant findings from vendor reports.

For organizations reviewing numerous SOC 2 reports, the release offers another option for organizing that analysis. Reviewers still need to check findings against the source report and determine whether its scope, exceptions, and customer responsibilities meet their organization’s requirements.

Source: ProcessUnity’s AI Agents announcement.

4. Bybit Completes SOC 2 Type II Audit Conducted By Deloitte

Announcement Date: September 29, 2026

Bybit announced completion of a SOC 2 Type II audit independently conducted by Deloitte. The cryptocurrency exchange said the examination assessed whether its security and operational controls operated effectively throughout the review period.

The company described the report as supporting institutional clients and partners conducting due diligence on its security and risk management practices. Its announcement highlighted management oversight, defined responsibilities, and the coordination of people, processes, and technology within its security program.

The SOC 2 report joins Bybit’s existing ISO/IEC 27001 certification and PCI DSS compliance validation. Each assessment addresses a different scope, giving customers and partners additional material to consider when evaluating the exchange’s controls.

The announcement names Deloitte but does not disclose the examination dates, detailed scope, auditor’s opinion, or any testing exceptions. Customers relying on the result should review the actual report to establish which services and controls were examined and whether the covered period meets their assessment requirements.

Source: Bybit’s announcement distributed through Chainwire.

SOC 2 News and Updates for October 2026

1. FSSI Completes First SOC 2 + HITRUST CSF Audit

Announcement Date: October 8, 2026

FSSI announced completion of its first SOC 2 + HITRUST CSF audit report, alongside its annual HIPAA audit. The print and mail provider handles sensitive client and customer information throughout document production and delivery, making its controls relevant to organizations outsourcing those services.

According to FSSI, the assessments reviewed information security, confidentiality, system availability, operational procedures, risk management, access controls, and data protection practices. The company said the reports provide customers with additional assurance about its control environment and service delivery processes.

The SOC 2 + HITRUST CSF designation is the central development. Customers evaluating the combined report should examine which HITRUST requirements it addresses and how those requirements fit within the SOC 2 examination. FSSI’s announcement does not establish that it received a separate HITRUST certification.

The release does not identify the auditor, examination period, report type, or testing exceptions. Customers using the result for vendor assessments will need the underlying report to confirm those details and determine whether the covered services match their outsourcing arrangements.

Source: FSSI’s SOC 2 + HITRUST CSF announcement.

2. Humanix Completes SOC 2 Type II Examination By Johanson Group

Announcement Date: October 7, 2026

Humanix announced completion of a SOC 2 Type II examination conducted by Johanson Group LLP. The company develops a platform that uses conversational AI to identify social engineering attempts across enterprise communication channels.

The platform processes sensitive interaction and identity information to assess suspicious requests, inconsistencies in claimed identities, and skipped verification steps. Humanix said the SOC 2 report gives customers an independent basis for evaluating the controls protecting that information.

Customers and prospective customers can request the report under a nondisclosure agreement. This provides security, risk, and procurement teams with examination details to consider when assessing Humanix for workflows involving account access and other sensitive actions.

The announcement does not disclose the examination period, selected Trust Services Criteria, or testing exceptions. Those details require review of the underlying report. The SOC 2 result concerns controls within the examination’s scope; the announcement provides no independent measurement of the platform’s accuracy in detecting social engineering attacks.

Source: Humanix’s SOC 2 Type II announcement.

How Bright Defense Can Help You

Bright Defense helps businesses prepare for SOC 2 examinations and maintain their security controls throughout the year. As you review SOC 2 news and updates, a documented compliance program makes it easier to assess whether your policies, controls, or audit preparation need attention.

Our team supports gap assessments, risk reviews, policy development, evidence collection, and remediation. Ongoing control monitoring and virtual CISO guidance help your organization stay prepared between examinations.

Explore our SOC 2 compliance services to prepare for your first examination or strengthen your existing program.

SOC 2 News: Your Questions Answered

1. Has SOC 2 Changed In 2026?

Developments in 2026 include guidance on AI use, increased attention to audit quality, and clarification of professional ethics requirements. These developments affect how practitioners approach examinations. They should not all be described as changes to the SOC 2 Trust Services Criteria or as new requirements for every organization.

2. Does The New AI Guidance Require A Separate SOC 2 Audit?

AICPA’s September guidance does not create a separate AI-specific SOC 2 examination. It addresses how a service organization’s use of AI affects existing SOC examinations. Organizations should discuss relevant AI services, data flows, and controls with their auditor when determining scope and evidence needs.

3. Is SOC 2 Becoming A Legal Requirement?

SOC 2 is generally voluntary, although customers can require a report through contracts or procurement policies. Regulatory proposals may consider SOC 2 for particular sectors. The SEC’s 2026 transfer-agent proposal asks whether independent assessments such as SOC 2 should be required; that question does not establish an adopted mandate.

4. Can A Company With A SOC 2 Report Still Experience A Data Breach?

Yes. A SOC 2 report provides assurance about specified controls within a defined system and examination period. It does not guarantee that a company will never experience a breach. An incident requires investigation before anyone can determine whether it involved controls covered by the report or raises questions about the examination.

5. Do Exceptions In A SOC 2 Report Mean The Company Failed Its Audit?

No. A testing exception does not automatically result in a modified auditor’s opinion. Its significance depends on factors such as its nature, frequency, and effect on meeting the applicable criteria. Readers should review the opinion, testing results, and management’s response together.