The annual audit passed. Three months later, nothing was compliant.

How we got here

In 2019, Alex Koval was reviewing a client's compliance posture three months after their SOC 2 audit. Access controls had drifted, encryption policies were inconsistent, and MFA enforcement had gaps: all things their auditor had validated as passing during the point-in-time review. The compliance checkbox said ready. The reality was not.

Alex teamed up with Dana Ortiz, who had spent years on the audit side and knew exactly how controls got checked without ongoing validation. Together they built SecTests: a platform that validates compliance controls continuously, so the evidence your auditor sees reflects your actual posture every day; not just once a year.

We launched in 2020 out of Portland, Oregon. Today the team is around 20 people: compliance specialists, platform developers, and a small team focused on framework coverage and evidence collection. We are profitable, independent, and not interested in building features nobody asked for.

Who builds SecTests

Security engineers, platform developers, and compliance specialists.