BloomPath AI Accelerates SOC 2 Readiness with Autonomous Pentesting using XBOW
What began as a rapid SOC 2 engagement is now shaping BloomPath’s shift toward continuous, autonomous security testing.
BloomPath AI is a continuous productivity intelligence platform that helps organizations streamline work, improve efficiency, and stay aligned on their goals. By analyzing signals from everyday tools such as task managers, documents, and communication systems, BloomPath surfaces actionable insights that eliminate waste, reduce delays, and support smarter decision-making—all without manual reporting or disruption to the team’s workflow.
Whether supporting fast-moving technology teams or operational functions inside nonprofits and service organizations, BloomPath enables leaders to accelerate outcomes, strengthen collaboration, and unlock the full potential of their people.
Founded in 2024, BloomPath AI’s mission is to bring continuous product and people management into the flow of work, enabling organizations to make faster, data-informed decisions.
XBOW dramatically accelerated our path to SOC 2 readiness. What usually takes traditional firms weeks of coordination and manual testing was completed in just a few days, from kickoff to an auditor-ready report. It gave our team confidence that we could move fast without compromising on quality.
- Priscilla Fong, Security Advisor, BloomPath
Challenge
As a fast-growing AI platform handling sensitive enterprise data, BloomPath AI prioritized achieving SOC 2 compliance to demonstrate its commitment to security and customer trust. Traditionally, a penetration test can stretch over six weeks, starting with multiple scoping calls, waiting for scheduling availability, then spending weeks on manual testing, reporting, and re-testing. Multiple handoffs, scheduling delays, and manual reporting make it nearly impossible for fast-moving teams to stay compliant without stalling development. BloomPath’s lean engineering team needed a faster, automated path to SOC 2 readiness that could deliver verified results without the drawn-out logistics or disruption of a traditional test.
Solution
The BloomPath AI Security team selected XBOW’s autonomous penetration testing platform to handle the assessment. XBOW quickly mapped BloomPath’s external application, identified vulnerabilities, and provided detailed remediation guidance aligned with SOC 2 standards.
With guidance from XBOW’s automated validation and remediation workflows, BloomPath’s engineers reviewed the verified findings, implemented fixes, and pushed secure updates into production. The initial assessment, which evaluated the security of BloomPath’s external applications without source code (blackbox testing), provided a realistic view of how an attacker would approach their environment.
For a lean team like ours, XBOW’s simplicity and flexibility were game changers. We managed setup and execution ourselves with zero friction and could trigger tests on demand whenever we needed verification. Retesting fixes was quick and seamless–a huge contrast to the delays and back-and-forth that come with traditional pentesting vendors.
- Priscilla Fong, Security Advisor, BloomPath
Full engagement, including the configuration, testing, validation process, and SOC report submission, was completed in a few days.
Results
BloomPath received a comprehensive, validated report that supported the SOC 2 submission and validation with auditors. XBOW’s automation helped BloomPath strengthen its security posture and streamline the compliance process.
Working with XBOW showed us how modern security testing should work: fast, thorough, and tightly aligned with our development cycles. Their validated findings and clear, actionable reporting made it easy for our team to move quickly on fixes and trust the results. We’re now building on that experience by adopting a continuous pentesting model that fits naturally with our release cycles.
- Hazim Macky, CTO, BloomPath
What's Next
Following the assessment, BloomPath is planning for a deeper evaluation, where XBOW’s agents will test with access to source code (whitebox testing). This complementary approach will help uncover deeper flaws that blackbox testing alone cannot detect. Read here to understand how XBOW combines static and dynamic testing.
Encouraged by the speed and depth of insights from the initial engagement, the Bloompath team plans to make continuous pentesting a core pillar of its security strategy with XBOW.