Continuous compliance validation

Prove compliance continuously with autonomous evidence collection instead of a point-in-time audit snapshot. Prancer maps every proven finding to the controls your auditors ask about, and re-validates them on a schedule you set rather than once a year.

Framework rollups

• PCI DSS 4.0 — including the requirement for regular internal and external penetration testing and segmentation validation.
• SOC 2 — recurring evidence for the common criteria covering vulnerability management and change control.
• HIPAA — technical safeguard validation across systems handling protected health information.
• ISO 27001:2022 and NIST CSF 2.0 — control-level mapping with captured proof per finding.
• OWASP Top 10 2021, DORA and NIS2 — application and operational-resilience coverage for EU obligations.

Evidence an auditor can verify

Compliance findings inherit the same grading doctrine as every other Prancer result: Exploited, Observed, AttackPathIdentified or Simulated, with Critical severity reserved for captured proof. An auditor sees the request, the response and the timestamp — not an assertion that a control exists.

Between-audit drift is where breaches live

Most organizations pass an assessment and then drift: a new deploy re-opens an egress path, a service account gains a role, a firewall rule is widened for a migration. Continuous validation catches that drift within a testing cycle instead of at the next audit. Reports export as OCSF 1.1.0 JSON, interactive HTML and Markdown, and feed directly into GRC, SIEM and ticketing pipelines.

See enterprise deployment, SSE control validation and the SwarmHack engine. Book a compliance walkthrough.