If you've shipped a SOC 2 Type II report, you know the rhythm. The first 270 days feel calm. The last 90 don't. Engineering rewires Slack channels, security cancels weekend plans, and someone — always — discovers a control they thought was covered by a vendor and isn't.
After working with 1,200+ teams through their first audit, we've found that this isn't a tooling problem in the traditional sense. The tools exist. The gaps are structural.
Three patterns we see in every failed audit
Auditors don't fail teams because they couldn't gather evidence. They fail teams because the evidence they gathered didn't match the controls they claimed.
- Evidence drift. Controls were defined in Q1, the stack changed in Q2, no one updated the mapping.
- Vendor blindspots. A subprocessor lost their own certification mid-cycle and nobody noticed.
- Manual screenshot debt. A control marked 'automated' actually requires a quarterly screenshot that was last taken in October.
What 'continuous evidence' actually means
Most platforms ship continuous evidence as a marketing page. In practice, what they ship is a connector that fetches data once a day and stores it next to a control. That's a snapshot, not continuous.
The bar we hold ourselves to
Continuous evidence means: every privileged action emits a signed event in real time, every control is mapped to a query against those events, and every query runs at least hourly with versioned results stored for 7 years.
What good looks like
An auditor opens your dashboard. They click any control. They see a stream of evidence dating back to the last audit. They click any event. They see who, what, where, when, with cryptographic chain-of-custody.
Time spent: minutes. Confidence: total. That's the bar.
// Define a control as a query, not a checklist.
export const accessReviewControl = {
id: 'CC6.3',
name: 'Quarterly access review',
evidence: query(`
SELECT actor, target, granted_at
FROM permission_grants
WHERE granted_at > NOW() - INTERVAL '90 days'
`)
}"We went from spending 3 weeks per quarter on SOC 2 evidence collection to 2 hours. Lumora pays for itself in the first audit."
— Sam Chen — VP Engineering, Atlas Finance
Alex is the founder of Lumora Cloud. Previously security lead at two SOC-2 audited startups, both of which he wishes he'd had Lumora for.