Home › Blog › The invisible 80%

The 80% a domain scan can't see

MAR 25, 2026 2 MIN READ

SOC 2 is mostly process and internal architecture. Here's a map of what lives outside any scanner's reach - and why it matters more than the grade.

Iceberg illustration: the fifth above the waterline is labelled with what scanners can see, including TLS and certificates, security headers, DNS records, public subdomains and exposed assets, while the far larger mass below is labelled with people and permissions, internal processes, access controls, backups and recovery, incident response and vendor management.

If an external scan covers roughly a fifth of what a SOC 2 audit looks at, it's worth being specific about the other four fifths. Not as a sales point - as a map, because most of the work is there.

Data isolation

Whether one customer's data can reach another's. Row-level security on shared tables, tenant scoping in API endpoints, key separation. An auditor will ask how it's enforced and how you'd know if it failed. Nothing about this is visible from a domain.

Backups and resilience

Not whether backups exist - whether anyone has restored one. Recovery point and recovery time objectives, tested rather than documented, plus what happens when a critical dependency goes down.

Access governance

Who has production access, whether MFA is enforced rather than merely offered, how quickly access is revoked when someone leaves, and whether anyone reviews the list periodically. Offboarding is where this usually falls down.

Engineering process

Change management, code review, how secrets are handled in CI, how deployments are approved. An auditor cares less about the tooling than about whether the process is consistently followed and evidenced.

People and policy

Written incident response, an annual risk assessment, security training for new hires. These are documents to write rather than settings to find - which makes them easy to defer indefinitely.

Vendor management

Every vendor that touches customer data, signed DPAs with each, and some review of their security posture. Most companies underestimate this list by half.

Why the visible fifth still matters

Because it's quick, concrete, and it's what a prospect sees first. Fixing email authentication or missing headers takes an afternoon; the six categories above take months. Doing the fast part first is sensible - as long as nobody mistakes it for the whole job.

We've mapped the visible fifth in detail in external security posture, and explained why we won't call the result a certificate in the previous post. The six categories above are not our invention: they are where the trust services criteria live, which our full guide to SOC 2 walks through one series at a time.

Questions people ask about this

What parts of SOC 2 can an external scan verify?

Only externally observable configuration: TLS setup, HTTP security headers, DNS and email authentication, publicly visible subdomains, exposed assets, cookie flags and CORS policy. These touch real Trust Services Criteria but cover only the visible slice of each.

What can't be checked from outside?

Data isolation between tenants, backup and restore testing, access governance and offboarding, engineering change process, incident response, and vendor management. All of it requires evidence from inside your systems or your documentation.

Where should I start if I'm preparing for an audit?

Fix the externally visible items first because they are quick and concrete, then work the internal checklist. The internal work takes far longer, so starting it early matters more than finishing the external items perfectly.

Start with the visible part

Ten external checks, then a readiness checklist for the part no scan reaches.

Run a free check

Related reading