GetSOC2

Your AI agents are logging in as humans and SOC 2 cannot tell

September 29, 2026. From issue 8 of The Compliance Brief, one story for companies buying a SOC 2 audit.

Last reviewed 2026-09-29Written by Jacob Masse, TrazTech Inc.

Issue 8 of The Compliance Brief went to subscribers on September 29, 2026. One of its 5 stories bears on SOC 2 audits, auditors and vendor reviews, and they are below in short form. The full issue, with every take in full, is on traztech.ca.

Source: BleepingComputer

A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. The argument is that existing SOC 2 controls have no way to distinguish the two, leaving a gap in access review and logging evidence.

Our take, in short

It is marketing content and the framing is overheated, but the underlying problem is one I run into on real engagements. If your agent authenticates as a staff member, your quarterly access review is describing a person who is not the one taking the actions, and your audit trail will not survive a serious customer question.

Read the full take on traztech.ca

Also in issue 8

Outside SOC 2 audits, auditors and vendor reviews, but in the same email:

Older: issue 7 All issues on GetSOC2