Proton.ai
How Security Consultants supported Proton.ai with risk assessment, a practical security work plan, and readiness guidance for its SOC 2 Type II audit.
The challenge
Proton.ai builds an AI-powered CRM for B2B distributors. Its customers use the platform to manage commercial information, making confidence in the security of that information an important part of the relationship. Proton set out to demonstrate its security practices through a SOC 2 Type II examination.
The preparation involved both security leadership and engineering. The team needed to assess risks, decide which actions to take, and establish who would own the work. Security Consultants supported that preparation through Attila Horvath, our principal consultant, working with Proton's engineering lead, Kostas Papadopoulos.
The solution
Assessing risk with the engineering team
Our principal consultant, Attila Horvath, worked in a CISO role alongside Proton's engineering lead on a risk assessment covering engineering and information security alongside business functions including human resources, finance, sales, and legal. It used a questionnaire based on the Cloud Security Alliance's CAIQ and Drata to review the responses.
Risks were evaluated using likelihood and impact. This gave the team a common way to compare concerns and prioritize its response across technical and organizational areas.
Turning assessment into assigned work
The project used an Asana risk-treatment tracker with named owners and risk ratings. Attila's assigned responsibilities included asset-register work, business-continuity and disaster-recovery documentation, and security policy work. Engineering actions were assigned separately to Proton's team.
The tracker connected identified risks to specific actions and owners, with security documentation and policy responsibilities assigned alongside technical work. This gave both the consultant and the engineering team a practical view of the work assigned to them.
Supporting SOC 2 preparation
Security Consultants' contribution combined this risk-based approach with guidance through SOC 2 Type II preparation. In his testimonial, Kostas credits Attila with helping improve Proton's security system and posture, providing advice, and guiding the team through the process.
The result
On September 18, 2024, independent auditor Prescient Assurance issued a SOC 2 Type II attestation letter for PRM Solutions, the business behind Proton.ai, with an unqualified opinion. The letter covered the Security trust services criteria for the period April 15 through July 31, 2024.
The auditor concluded that the controls described were suitably designed and operated effectively during the examination period, subject to the complementary controls described in its opinion. Proton publicly announced the achievement the following day.
Security Consultants supported risk assessment and readiness, while Prescient Assurance independently examined the controls and issued the audit opinion. Kostas's review below adds the client's perspective on the guidance provided by our principal consultant.
Preparing a SaaS team for its own examination? Explore our SOC 2 consulting service to discuss risk assessment, control preparation, and audit-readiness support.
"Attila is a rock star when it comes to security consulting! He is experienced with enterprise-level security and he guided us through our SOC 2 Type 2 certification. He helped us revamp up our security system and posture and gave great advice. Thanks to Attila, we passed the audit without any exceptions. If you need a security pro who knows their stuff and will help you get results, Attila's your guy. Highly recommend!"
