Your e2e results are SOC 2 evidence

Vanta, Drata, Secureframe... they've automated the infra side really well. "Yes MFA is configured." "Yes access reviews happened." But they can't see inside your application. They confirm MFA is enabled but can't prove MFA actually works for your users.

That evidence is still someone taking screenshots and pasting them into Confluence lol

Thomas Ptacek described SOC 2 audits as "a giant spreadsheet questionnaire and a battery of screenshots." Edera called evidence collection "a quarterly scavenger hunt, a tax on engineering velocity that produces almost no security value."

Here's the thing though. A test that verifies "user logs in with MFA, accesses admin panel, cannot view other org's data"... that IS what CC7.2 and CC6.1 require. Your CI probably already runs something like this. But CI logs expire, dashboards aren't formatted for auditors, nobody tags test results to control IDs.

There's roughly a 20% manual gap. The application-level testing evidence that compliance platforms can't touch. Two engineers, two weeks, 200 pages of screenshots. Every audit cycle...

How much time does your team burn on evidence collection per cycle? Has anyone automated the bridge between CI results and audit evidence?