What the standards actually say.

SOC 2

• 01 SOC 2 compliance: what it is, what it costs, how long it takes› There is no such thing as SOC 2 certified. What the report actually is, who is allowed to sign it, why you probably need one category and not five, and the real 2026 cost stack.
• 02 SOC 2 audit cost in 2026: every line item, priced› The three line items vendors blur, what actually sets the CPA's floor, why the published $30K to $50K ranges are written by people selling platforms, and our all-in number.
• 03 Does SOC 2 require a penetration test?› No criterion mandates one. What the AICPA actually says, why auditors expect a test anyway, real 2026 price bands, and the observation-window timing rule.
• 04 Which platforms include a penetration test with SOC 2 compliance?› Almost none. Why Vanta and Drata refer the test to a partner, the one line that can never be bundled no matter who is selling, and what each route costs.

ISO 27001

• 05 Does ISO 27001 require penetration testing?› No control names it. Why A.8.8 and A.8.29 make a test the practical answer anyway, the scope mismatch that becomes a nonconformity, and what to hand the auditor.

Penetration testing

• 06 How much does penetration testing cost?› $5,000 to $30,000 for a web app, and under $4,000 is a scan. The 2026 bands by engagement type, the day-rate math behind every quote, and our public price list.
• 07 Which frameworks require a third-party penetration test?› Three do: FedRAMP, CSA STAR and DORA. PCI and NYDFS accept an internal tester, SOC 2 and ISO 27001 require no test at all. The control text for each, quoted.

PCI DSS

• 08 PCI DSS penetration testing requirements› The framework that mandates a pentest in normative text. Requirement 11.4 clause by clause, the retest everyone forgets to price, and why it does not need a QSA.

Security research

• 09 CVE-2026-73649: a critical RCE we found in velocity.js› CVSS 9.8, CVE-2026-73649 (GHSA-7gfh-x38p-prh3), fixed in 2.1.7. The property-read chain to the Function constructor, why the prior prototype-pollution patch missed it, and how to fix it.
• 10 A disabled key-size check we reported in Tor's arti› A misplaced ! disabled an RSA key-size check in Tor's arti. How if !x == y compiles in Rust, why it slipped past clippy and the tests, and the one-line fix Tor merged.
• 11 The Function constructor escapes safe eval in JSONPath-Plus› A property read returned the Function constructor in a library pulled 12M times a week, so obj.constructor gave RCE. The guard gap, the one-clause fix, and the CVE chain.
• 12 A cookie-leak bug we reported in tough-cookie› A URL-parsing differential leaked victim.com cookies to attacker hosts, in a library pulled 480M times a month. The decodeURI root cause, the fix, and a note on crediting researchers.

Spotted an error? We correct fast: [email protected].