Does Cyber Crucible have a SOC 2 report?

Short answer: No. Cyber Crucible does not currently hold a SOC 2 attestation, and it says so plainly rather than implying otherwise. The reason is architectural: Cyber Crucible is a locally-executing software product, not a cloud custodian of customer data, so the SOC 2 service-organization model — which attests to how a provider stores, processes, and transmits your data on its own systems — does not map cleanly to it. 
 Why most customers have not required one 
 SOC 2 attests to the controls of a service organization that holds customer data. Cyber Crucible's design removes that premise: 
 
 Threat detection and response run on the endpoint, at the kernel level, on the customer's own device. 
 Customer files, credentials, encryption keys, and session tokens are never collected, transmitted, or stored by Cyber Crucible. 
 The platform can be deployed fully on-premises or air-gapped, inside the customer's own infrastructure. 
 
 Because the highest-risk categories of data are never in Cyber Crucible's custody, a large part of the vendor-risk surface a SOC 2 is meant to address is removed by design rather than merely controlled. 
 What stands in its place 
 For reviewers who work from a questionnaire, Cyber Crucible provides a prepared vendor security package that supplies the underlying control evidence directly, and maps its controls to the SOC 2 Trust-Service Criteria and the NIST Cybersecurity Framework so a reviewer can complete a standard questionnaire from it. The package is available under a mutual NDA from dpo@cybercrucible.com . 
 The assurance roadmap is kept under evaluation against customer needs; this page will be updated if that position changes.