Appearance
Penetration Test Results Log
Requirement: HIPAA §164.308(a)(8) — Periodic technical security evaluation. SOC2 CC7.1/CC7.2 — vulnerability detection and management. Evidence that penetration testing runs regularly and findings are tracked to resolution.
Owner: Rory Update frequency: After each scan cycle — within 5 business days Auditor use: This log summarises the three-layer pen test programme. Raw evidence (vpentest.io reports, attack.bedrockcybersecurity.org campaign history, GitHub Actions artifacts) is available on request.
Programme Overview — Three Layers
Cirius runs three complementary security assessment mechanisms that together satisfy HIPAA §164.308(a)(8) and SOC2 CC7.1 requirements for periodic technical security evaluation.
Layer 1 — Vonahi vPenTest (monthly internal scan)
What: Commercial automated penetration testing appliance. VM deployed in Azure hub VNet (snet-vpentest 10.99.8.0/24) with reach into PROD (10.20.0.0/16) and Identity (10.10.0.0/16) networks. Also deployed in AWS DR. Scans from inside the network — mimics a threat actor who has already gained internal access.
Cadence: Monthly automated scans.
Evidence location: Reports available in vpentest.io console (app.vpentest.io) under the Cirius organisation. Download PDF reports for each scan cycle.
Retrieving evidence for auditors:
- Log in to app.vpentest.io
- Navigate to Reports → select the relevant scan
- Export PDF — provide to auditor as the primary internal scan evidence artifact
Layer 2 — attack-teams autonomous purple team (weekly)
What: Cirius's internal autonomous purple team platform (bedrock-attack repo, live UI at attack.bedrockcybersecurity.org). Five cooperating agents run weekly (Monday 06:00 UTC):
- REDTEAM_BLACK — external black-box recon from AWS DR (no internal creds): DNS enumeration, TLS inspection, public threat intel, supply-chain checks
- REDTEAM_GREY — Azure configuration audit via read-only service principal (
sp-purple-auditor): misconfiguration detection, role assignment review, NSG auditing - BLUETEAM — detection validation: checks whether Red activity triggered alerts in LAW, Cortex XDR, Arctic Wolf; produces
detection_gapfindings where actions went undetected - PURPLE_TEAM — correlates all findings into unified attack-path gap reports
- REMEDIATION — creates/updates/deduplicates stories in SecOps; sends campaign summary emails
Cadence: Weekly. Campaign pipeline: checkin → grey → blueteam-grey → black → blueteam-black → referee → remediation
Authorization: Signed by Rory Garshol 2026-04-20. Expires 2027-04-20. Authorization document: bedrock-attack/AUTHORIZATION.md.
Evidence location: Campaign history at attack.bedrockcybersecurity.org. Findings written to SecOps under Purple Team project (epic a1f62f95). Campaign summary emails sent to Rory after each run.
Retrieving evidence for auditors:
- Browse
attack.bedrockcybersecurity.org→ Campaigns for run history - SecOps → Purple Team project for correlated findings
- Forward campaign summary emails from the Rory mailbox as supplemental evidence
Layer 3 — bedrock-soc external surface scan (monthly)
What: Automated external-perspective scan of all public-facing domains and AWS internet-facing load balancers. Uses Nmap (port scan) and Nuclei (CVE + misconfiguration templates). Runs from GitHub Actions — no internal network access, no credentials. Pure attacker-perspective external assessment.
Cadence: Monthly cron — 1st of each month, 06:00 UTC.
Pipeline: AWS ELB discovery → Nmap port scan → Nuclei template scan → findings emailed via ACS → HIGH/CRITICAL posted to SecOps → raw files stored as GitHub Actions artifacts (365-day retention).
Targets: ciriusgroup.com, soc.bedrockcybersecurity.org, grc.bedrockcybersecurity.org, dashboard.ciriusgroup.com, hub.ciriusgroup.com, ciriusdde.com, dashboard.ciriusdde.com, plus any AWS internet-facing ELBs discovered at run time.
Evidence location: GitHub Actions artifacts in Bedrock-Cybersecurity/bedrock-soc.
Retrieving evidence:
# List runs
gh run list --repo Bedrock-Cybersecurity/bedrock-soc --workflow "monthly-pentest.yml" --limit 24
# Download artifacts from a specific run
gh run download <run-id> --repo Bedrock-Cybersecurity/bedrock-soc --dir ./pentest-artifacts/Artifacts retained 365 days. First automated run: 2026-07-01.
Layer 1 — Vonahi vPenTest Results Log
2026
| Month | Scan Date | Scope | Critical | High | Medium | Low/Info | All Resolved? | Report in vpentest.io |
|---|---|---|---|---|---|---|---|---|
| January 2026 | (populate) | Internal PROD + Identity | ||||||
| February 2026 | ||||||||
| March 2026 | ||||||||
| April 2026 | ||||||||
| May 2026 | ||||||||
| June 2026 | ||||||||
| July 2026 | ||||||||
| August 2026 | ||||||||
| September 2026 |
Populate each row within 5 business days of the monthly scan. Pull totals from the vpentest.io PDF report.
Layer 2 — attack-teams Campaign Log
Weekly campaigns write findings directly to SecOps and attack.bedrockcybersecurity.org. This table summarises notable findings and detection gaps identified. Individual stories are in SecOps.
2026
| Week of | Run Status | Notable Findings | Detection Gaps | SecOps Stories Created |
|---|---|---|---|---|
| 2026-04-21 | (first run — populate) | |||
| (weekly — populate from campaign emails) |
Populate monthly from the weekly campaign summary emails. Full detail in SecOps Purple Team project.
Layer 3 — External Surface Scan Results Log
2026
| Month | Run Date | Endpoints Scanned | Critical | High | Medium | Low/Info | All Resolved? | Notes |
|---|---|---|---|---|---|---|---|---|
| July 2026 | (first run 2026-07-01) | 9+ | ||||||
| August 2026 | ||||||||
| September 2026 | ||||||||
| October 2026 | ||||||||
| November 2026 | ||||||||
| December 2026 |
Populate each row within 5 business days of the 1st-of-month run.
Open Findings Tracker
All HIGH/CRITICAL findings from any layer — tracked until a rescan confirms resolution.
| Finding ID | Layer | Month Found | Severity | Tool | Description | Endpoint / Asset | Remediation Status | Resolved Date |
|---|---|---|---|---|---|---|---|---|
| (add as needed) |
Remediation SLAs:
| Severity | SLA |
|---|---|
| Critical | Same day |
| High | Within 1 week |
| Medium | Within 1 month |
| Low / Informational | Next review cycle |
If a finding cannot be remediated within SLA, create a risk acceptance entry in compliance/risk-acceptance-register.md with justification and compensating controls.
False Positive Log
| Template / Finding | Layer | First Seen | Why False Positive | Exclusion Added? |
|---|---|---|---|---|
| (add as identified) |
Canary Verification Status
Verified alongside each monthly external scan cycle.
| Month | Canaries Verified | All Active? | Notes |
|---|---|---|---|
| January 2026 | |||
| February 2026 | |||
| March 2026 | |||
| April 2026 | |||
| May 2026 | |||
| June 2026 | CT-001, CT-002, CT-003, CT-004 | Yes | Verified 2026-06-27 — all 4 tokens ACTIVE, webhook returning 200 |
Auditor Evidence Package
For the SOC2 September 2026 audit:
- This log — programme overview and monthly summaries for all three layers
- vpentest.io PDF reports — Layer 1 monthly internal scan evidence (Jan–Sep 2026)
- attack.bedrockcybersecurity.org campaign history — Layer 2 weekly purple team evidence (Apr–Sep 2026)
- Authorization document —
bedrock-attack/AUTHORIZATION.mdsigned 2026-04-20 - GitHub Actions run history — Layer 3 external scan evidence:
gh run list --repo Bedrock-Cybersecurity/bedrock-soc --workflow "monthly-pentest.yml" \ --limit 12 --json databaseId,conclusion,startedAt,status - Finding resolution evidence — if any High/Critical findings were found and fixed, provide before/after evidence showing the finding resolved
- SecOps Purple Team stories — attack-teams findings and remediation record
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Initial draft — external scan log only | Rory |
| June 2026 | Rewritten to document full three-layer programme: Vonahi vPenTest (monthly internal), attack-teams purple team (weekly continuous), bedrock-soc external scan (monthly). Added separate result tables per layer and updated auditor evidence package. | Kobe |