Threat.Digital Completes SOC 2 Type II Examination for the DiligenAI Platform

Threat.Digital has completed a SOC 2 Type II examination for the DiligenAI Platform.

For customers using DiligenAI for due diligence, adverse media screening, third-party risk, enhanced due diligence, and ongoing monitoring, the report provides an independent assessment of the controls behind the platform.

What a Type 2 examination covers

A SOC 2 examination looks at the controls a service organization has in place around its systems and operations.

The Type 2 distinction is important because the examination covers a period of time. The auditor evaluates both whether the controls were appropriately designed and whether they operated effectively during the examination period.

For DiligenAI, that included controls across areas such as access management, risk assessment, system operations, change management, vendor management, security monitoring, business continuity, and other parts of the operating environment.

The independent auditor tested those controls using procedures that included inspection of documentation and system evidence, observation, inquiry, and selected re-performance of control procedures.

The auditor issued an opinion that, in all material respects, the controls described in the report were suitably designed and operated effectively throughout the examination period.

Why we went through the process

Security reviews are already a normal part of working with many of our customers and partners.

Due diligence firms, financial institutions, TPRM platforms, and other organizations often need to understand how a technology provider manages access, protects information, deploys software changes, evaluates its own vendors, and responds to operational risks.

Until now, answering those questions often meant providing policies, completing questionnaires, and explaining individual controls.

The SOC 2 process puts much of that information into a structured framework and adds independent testing.

It also required us to document and evidence processes that normally happen behind the product. That includes routine work such as reviewing access, managing changes to production systems, assessing vendors, maintaining security policies, testing recovery processes, and tracking security-related activity.

Security controls also have to be maintained

Completing the examination is one point in an ongoing process.

DiligenAI continues to change. We release software, add capabilities, work with technology providers, and update the infrastructure supporting the platform. The controls around those systems have to change with them.

That makes the work fairly similar to other parts of operating Threat.Digital. The platform itself is continuously maintained, and the processes used to secure and govern it need the same treatment.

Our SOC 2 Type II report gives customers and partners a formal way to review that work as part of their own vendor and third-party risk processes.