Secure AI Agent Best Practices - Part 5: Security Monitoring & Auditing

Security is not a one-time implementation - it's an ongoing process of monitoring, auditing, and continuous improvement. Even with perfect authentication, authorization, encryption, and key management from Parts 1-4, new vulnerabilities emerge, attack patterns evolve, and system complexity grows.

This final part of our security series will teach you to implement comprehensive security monitoring and auditing that ensures your AI agent remains secure throughout its entire lifecycle.

Why Continuous Security Monitoring is Essential

The Evolving Threat Landscape Security threats against AI systems are constantly evolving:

AI-Specific Attack Vectors

• Prompt injection attacks that manipulate AI behavior
• Model poisoning through malicious training data
• Data extraction attacks that steal training data from models
• Adversarial inputs designed to cause AI failures

Traditional Security Threats

• API vulnerabilities in your agent's endpoints
• Dependency vulnerabilities in third-party packages
• Infrastructure attacks on your hosting platform
• Social engineering targeting your development team

Compliance Requirements Many industries require continuous security monitoring:

• SOC 2 Type II: Requires ongoing security controls monitoring
• GDPR: Mandates breach detection and reporting within 72 hours
• HIPAA: Requires comprehensive audit trails for healthcare data
• PCI DSS: Demands continuous monitoring for payment data

What You'll Learn in This Tutorial

By the end of this tutorial, you'll have:

• ✅ Automated security scanning that detects vulnerabilities continuously
• ✅ Real-time threat monitoring with intelligent alerting
• ✅ Comprehensive audit logging for compliance and forensics
• ✅ Incident response procedures for security breaches
• ✅ Security metrics dashboard for ongoing visibility
• ✅ Compliance reporting frameworks for regulatory requirements

Estimated Time: 45-50 minutes

---

Step 1: Understanding Security Monitoring Architecture

Effective security monitoring requires a comprehensive approach that covers all aspects of your AI agent system.

Security Monitoring Components

Detection Layer Identifies potential security issues through:

• Automated vulnerability scanning of code and dependencies
• Behavioral analysis of user and system activity
• Anomaly detection for unusual patterns
• Threat intelligence integration for known attack patterns

Analysis Layer Processes security events to:

• Correlate events across different systems
• Assess threat severity and potential impact
• Filter false positives to reduce alert fatigue
• Prioritize responses based on risk levels

Response Layer Takes action when threats are detected:

• Automated mitigation for known threat patterns
• Alert escalation to security teams
• System isolation for severe threats
• Evidence collection for forensic analysis

Security Monitoring Architecture

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   Detection     │    │    Analysis     │    │    Response     │
│                 │    │                 │    │                 │
│ • Vuln Scanning │───▶│ • Event Corr.   │───▶│ • Auto Mitigation│
│ • Behavior Mon. │    │ • Threat Assess.│    │ • Alert Escalation│
│ • Anomaly Det.  │    │ • False Pos.    │    │ • System Isolation│
│ • Threat Intel  │    │ • Risk Priority │    │ • Evidence Collect│
└─────────────────┘    └─────────────────┘    └─────────────────┘

---

Step 2: Implementing Automated Vulnerability Scanning

Automated scanning catches security issues before they can be exploited.

Comprehensive Vulnerability Scanner

// security/vulnerability-scanner.js

const fs = require('fs').promises;
const path = require('path');
const { execSync } = require('child_process');

class VulnerabilityScanner {
    constructor(config = {}) {
        this.config = {
            // Scanning configuration
            scanIntervalHours: config.scanIntervalHours || 24,
            includeDevDependencies: config.includeDevDependencies || false,
            severityThreshold: config.severityThreshold || 'medium',
            
            // Reporting configuration
            reportPath: config.reportPath || './security-reports',
            alertOnCritical: config.alertOnCritical !== false,
            
            // Integration settings
            slackWebhook: config.slackWebhook || process.env.SECURITY_SLACK_WEBHOOK,
            emailAlerts: config.emailAlerts || process.env.SECURITY_EMAIL_ALERTS
        };
        
        // Vulnerability tracking
        this.knownVulnerabilities = new Map();
        this.scanHistory = [];
        
        // Initialize scanner
        this.initializeScanner();
    }
    
    async initializeScanner() {
        /**
         * Initialize vulnerability scanner with required tools
         */
        
        try {
            // Create reports directory
            await fs.mkdir(this.config.reportPath, { recursive: true });
            
            // Check for required scanning tools
            await this.validateScanningTools();
            
            // Start automated scanning
            this.startAutomatedScanning();
            
            console.log('✅ Vulnerability scanner initialized');
            
        } catch (error) {
            console.error('❌ Failed to initialize vulnerability scanner:', error);
            throw error;
        }
    }
    
    async validateScanningTools() {
        /**
         * Validate that required security scanning tools are available
         */
        
        const requiredTools = [
            { command: 'npm audit --version', name: 'npm audit' },
            { command: 'git --version', name: 'git' }
        ];
        
        for (const tool of requiredTools) {
            try {
                execSync(tool.command, { stdio: 'ignore' });
                console.log(`✅ ${tool.name} available`);
            } catch (error) {
                console.warn(`⚠️ ${tool.name} not available - some scans may be limited`);
            }
        }
    }
    
    startAutomatedScanning() {
        /**
         * Start automated vulnerability scanning
         */
        
        // Run initial scan
        this.performComprehensiveScan();
        
        // Schedule regular scans
        setInterval(() => {
            this.performComprehensiveScan();
        }, this.config.scanIntervalHours * 60 * 60 * 1000);
        
        console.log(`🔍 Automated scanning started (every ${this.config.scanIntervalHours} hours)`);
    }
    
    async performComprehensiveScan() {
        /**
         * Perform comprehensive security scan
         */
        
        const scanId = crypto.randomUUID();
        const startTime = Date.now();
        
        console.log(`🔍 Starting comprehensive security scan: ${scanId}`);
        
        const scanResults = {
            scanId: scanId,
            timestamp: new Date().toISOString(),
            duration: 0,
            scans: {},
            summary: {
                totalVulnerabilities: 0,
                criticalVulnerabilities: 0,
                newVulnerabilities: 0,
                fixedVulnerabilities: 0
            }
        };
        
        try {
            // 1. Dependency vulnerability scan
            scanResults.scans.dependencies = await this.scanDependencies();
            
            // 2. Code security scan
            scanResults.scans.codeAnalysis = await this.scanCodeSecurity();
            
            // 3. Configuration security scan
            scanResults.scans.configuration = await this.scanConfiguration();
            
            // 4. API security scan
            scanResults.scans.apiSecurity = await this.scanAPIEndpoints();
            
            // 5. Infrastructure scan (if applicable)
            scanResults.scans.infrastructure = await this.scanInfrastructure();
            
            // Calculate summary
            scanResults.summary = this.calculateScanSummary(scanResults.scans);
            scanResults.duration = Date.now() - startTime;
            
            // Store scan results
            await this.storeScanResults(scanResults);
            
            // Check for critical issues
            if (scanResults.summary.criticalVulnerabilities > 0) {
                await this.handleCriticalVulnerabilities(scanResults);
            }
            
            // Generate and send report
            await this.generateSecurityReport(scanResults);
            
            console.log(`✅ Security scan completed: ${scanId} (${scanResults.duration}ms)`);
            console.log(`   Total vulnerabilities: ${scanResults.summary.totalVulnerabilities}`);
            console.log(`   Critical vulnerabilities: ${scanResults.summary.criticalVulnerabilities}`);
            
        } catch (error) {
            console.error(`❌ Security scan failed: ${scanId}`, error);
            
            // Send failure alert
            await this.sendScanFailureAlert(scanId, error);
        }
        
        return scanResults;
    }
    
    async scanDependencies() {
        /**
         * Scan npm dependencies for known vulnerabilities
         */
        
        console.log('🔍 Scanning dependencies for vulnerabilities...');
        
        try {
            // Run npm audit
            const auditCommand = this.config.includeDevDependencies 
                ? 'npm audit --json'
                : 'npm audit --production --json';
            
            const auditOutput = execSync(auditCommand, { 
                encoding: 'utf8',
                stdio: ['ignore', 'pipe', 'ignore'] // Ignore stderr to prevent throwing on vulnerabilities
            });
            
            const auditResults = JSON.parse(auditOutput);
            
            // Process audit results
            const vulnerabilities = [];
            
            if (auditResults.vulnerabilities) {
                for (const [packageName, vulnData] of Object.entries(auditResults.vulnerabilities)) {
                    for (const advisory of vulnData.via) {
                        if (typeof advisory === 'object') {
                            vulnerabilities.push({
                                package: packageName,
                                severity: advisory.severity,
                                title: advisory.title,
                                url: advisory.url,
                                cwe: advisory.cwe,
                                cvss: advisory.cvss
                            });
                        }
                    }
                }
            }
            
            console.log(`📊 Dependency scan complete: ${vulnerabilities.length} vulnerabilities found`);
            
            return {
                scanType: 'dependencies',
                vulnerabilities: vulnerabilities,
                totalPackages: auditResults.metadata?.totalDependencies || 0,
                summary: this.categorizeBySeverity(vulnerabilities)
            };
            
        } catch (error) {
            console.error('❌ Dependency scan failed:', error);
            
            return {
                scanType: 'dependencies',
                error: error.message,
                vulnerabilities: [],
                summary: { critical: 0, high: 0, medium: 0, low: 0 }
            };
        }
    }
    
    async scanCodeSecurity() {
        /**
         * Scan source code for security issues
         */
        
        console.log('🔍 Scanning code for security issues...');
        
        const codeIssues = [];
        
        try {
            // Define security patterns to look for
            const securityPatterns = [
                {
                    pattern: /process\.env\.[A-Z_]+/g,
                    severity: 'low',
                    description: 'Environment variable usage - ensure proper validation',
                    category: 'configuration'
                },
                {
                    pattern: /eval\s*\(/g,
                    severity: 'critical',
                    description: 'Use of eval() function - potential code injection vulnerability',
                    category: 'code_injection'
                },
                {
                    pattern: /innerHTML\s*=/g,
                    severity: 'high',
                    description: 'Use of innerHTML - potential XSS vulnerability',
                    category: 'xss'
                },
                {
                    pattern: /password\s*[:=]\s*['"]/gi,
                    severity: 'critical',
                    description: 'Hardcoded password detected',
                    category: 'hardcoded_secrets'
                },
                {
                    pattern: /api[_-]?key\s*[:=]\s*['"]/gi,
                    severity: 'critical',
                    description: 'Hardcoded API key detected',
                    category: 'hardcoded_secrets'
                }
            ];
            
            // Scan source files
            const sourceFiles = await this.getSourceFiles();
            
            for (const filePath of sourceFiles) {
                const fileContent = await fs.readFile(filePath, 'utf8');
                
                for (const pattern of securityPatterns) {
                    const matches = fileContent.match(pattern.pattern);
                    
                    if (matches) {
                        for (const match of matches) {
                            codeIssues.push({
                                file: filePath,
                                line: this.getLineNumber(fileContent, match),
                                match: match,
                                severity: pattern.severity,
                                description: pattern.description,
                                category: pattern.category
                            });
                        }
                    }
                }
            }
            
            console.log(`📊 Code security scan complete: ${codeIssues.length} issues found`);
            
            return {
                scanType: 'code_security',
                issues: codeIssues,
                filesScanned: sourceFiles.length,
                summary: this.categorizeBySeverity(codeIssues)
            };
            
        } catch (error) {
            console.error('❌ Code security scan failed:', error);
            
            return {
                scanType: 'code_security',
                error: error.message,
                issues: [],
                summary: { critical: 0, high: 0, medium: 0, low: 0 }
            };
        }
    }
    
    async getSourceFiles() {
        /**
         * Get list of source files to scan
         */
        
        const sourceExtensions = ['.js', '.ts', '.jsx', '.tsx', '.json'];
        const excludePatterns = ['node_modules', '.git', 'dist', 'build'];
        
        const files = [];
        
        async function scanDirectory(dir) {
            const entries = await fs.readdir(dir, { withFileTypes: true });
            
            for (const entry of entries) {
                const fullPath = path.join(dir, entry.name);
                
                // Skip excluded directories
                if (entry.isDirectory() && !excludePatterns.some(pattern => entry.name.includes(pattern))) {
                    await scanDirectory(fullPath);
                } else if (entry.isFile() && sourceExtensions.some(ext => entry.name.endsWith(ext))) {
                    files.push(fullPath);
                }
            }
        }
        
        await scanDirectory('.');
        return files;
    }
    
    categorizeBySeverity(items) {
        /**
         * Categorize vulnerabilities/issues by severity
         */
        
        const summary = { critical: 0, high: 0, medium: 0, low: 0 };
        
        for (const item of items) {
            const severity = item.severity || 'medium';
            if (summary.hasOwnProperty(severity)) {
                summary[severity]++;
            }
        }
        
        return summary;
    }
}

Vulnerability Scanner Explanation:

Automated Detection: The scanner runs automatically on a schedule, ensuring vulnerabilities are detected quickly without manual intervention.

Multiple Scan Types: Different types of scans (dependencies, code, configuration) catch different categories of vulnerabilities.

Severity Classification: Issues are classified by severity to help prioritize remediation efforts.

Pattern Matching: Code scanning uses regex patterns to detect common security anti-patterns like hardcoded secrets.

---

Step 3: Real-Time Threat Monitoring

Beyond vulnerability scanning, you need real-time monitoring to detect active attacks and suspicious behavior.

Threat Detection System

// security/threat-monitor.js

class ThreatMonitor {
    constructor(config = {}) {
        this.config = {
            // Detection thresholds
            maxFailedLogins: config.maxFailedLogins || 5,
            maxRequestsPerMinute: config.maxRequestsPerMinute || 100,
            maxTokensPerHour: config.maxTokensPerHour || 10000,
            
            // Monitoring settings
            monitoringWindow: config.monitoringWindow || 300000, // 5 minutes
            alertCooldown: config.alertCooldown || 900000, // 15 minutes
            
            // Integration settings
            alertWebhook: config.alertWebhook || process.env.SECURITY_ALERT_WEBHOOK
        };
        
        // Threat tracking
        this.threatEvents = [];
        this.activeThreats = new Map();
        this.alertHistory = [];
        
        // User behavior tracking
        this.userBehavior = new Map();
        this.ipBehavior = new Map();
        
        // Start monitoring
        this.startThreatMonitoring();
        
        console.log('✅ Threat monitoring system initialized');
    }
    
    startThreatMonitoring() {
        /**
         * Start real-time threat monitoring
         */
        
        // Analyze threat events every minute
        setInterval(() => {
            this.analyzeThreatEvents();
        }, 60000);
        
        // Clean up old events every hour
        setInterval(() => {
            this.cleanupOldEvents();
        }, 3600000);
        
        console.log('🔍 Real-time threat monitoring started');
    }
    
    recordSecurityEvent(eventType, eventData) {
        /**
         * Record security event for analysis
         * 
         * Args:
         *   eventType: Type of security event (login_failed, api_abuse, etc.)
         *   eventData: Event details (user, IP, timestamp, etc.)
         */
        
        const securityEvent = {
            id: crypto.randomUUID(),
            type: eventType,
            timestamp: new Date().toISOString(),
            data: eventData,
            severity: this.calculateEventSeverity(eventType, eventData)
        };
        
        // Store event
        this.threatEvents.push(securityEvent);
        
        // Update behavior tracking
        this.updateBehaviorTracking(securityEvent);
        
        // Check for immediate threats
        if (securityEvent.severity === 'critical') {
            this.handleCriticalThreat(securityEvent);
        }
        
        console.log(`🚨 Security event recorded: ${eventType} (${securityEvent.severity})`);
    }
    
    calculateEventSeverity(eventType, eventData) {
        /**
         * Calculate severity level for security events
         */
        
        const severityMap = {
            // Authentication events
            'login_failed': 'low',
            'login_brute_force': 'high',
            'account_locked': 'medium',
            
            // API abuse events
            'rate_limit_exceeded': 'medium',
            'api_abuse_detected': 'high',
            'unusual_token_usage': 'medium',
            
            // Access control events
            'unauthorized_access': 'high',
            'privilege_escalation': 'critical',
            'data_access_violation': 'critical',
            
            // System events
            'system_compromise': 'critical',
            'malware_detected': 'critical',
            'data_breach': 'critical'
        };
        
        let baseSeverity = severityMap[eventType] || 'medium';
        
        // Adjust severity based on event data
        if (eventData.repeated_attempts > 10) {
            baseSeverity = this.escalateSeverity(baseSeverity);
        }
        
        if (eventData.admin_account) {
            baseSeverity = this.escalateSeverity(baseSeverity);
        }
        
        return baseSeverity;
    }
    
    escalateSeverity(currentSeverity) {
        /**
         * Escalate severity level
         */
        
        const severityLevels = ['low', 'medium', 'high', 'critical'];
        const currentIndex = severityLevels.indexOf(currentSeverity);
        
        if (currentIndex < severityLevels.length - 1) {
            return severityLevels[currentIndex + 1];
        }
        
        return currentSeverity;
    }
    
    updateBehaviorTracking(securityEvent) {
        /**
         * Update user and IP behavior tracking for anomaly detection
         */
        
        const { data } = securityEvent;
        
        // Track user behavior
        if (data.userId) {
            if (!this.userBehavior.has(data.userId)) {
                this.userBehavior.set(data.userId, {
                    events: [],
                    patterns: {},
                    riskScore: 0
                });
            }
            
            const userBehavior = this.userBehavior.get(data.userId);
            userBehavior.events.push(securityEvent);
            
            // Update risk score
            userBehavior.riskScore = this.calculateUserRiskScore(userBehavior.events);
        }
        
        // Track IP behavior
        if (data.ipAddress) {
            if (!this.ipBehavior.has(data.ipAddress)) {
                this.ipBehavior.set(data.ipAddress, {
                    events: [],
                    patterns: {},
                    riskScore: 0
                });
            }
            
            const ipBehavior = this.ipBehavior.get(data.ipAddress);
            ipBehavior.events.push(securityEvent);
            
            // Update risk score
            ipBehavior.riskScore = this.calculateIPRiskScore(ipBehavior.events);
        }
    }
    
    async analyzeThreatEvents() {
        /**
         * Analyze recent threat events for patterns and anomalies
         */
        
        const recentEvents = this.getRecentEvents(this.config.monitoringWindow);
        
        if (recentEvents.length === 0) {
            return;
        }
        
        console.log(`🔍 Analyzing ${recentEvents.length} recent security events...`);
        
        // Check for attack patterns
        const attackPatterns = [
            this.detectBruteForceAttacks(recentEvents),
            this.detectAPIAbuse(recentEvents),
            this.detectAnomalousAccess(recentEvents),
            this.detectDataExfiltration(recentEvents)
        ];
        
        // Process detected patterns
        for (const pattern of attackPatterns) {
            if (pattern.detected) {
                await this.handleThreatPattern(pattern);
            }
        }
    }
    
    detectBruteForceAttacks(events) {
        /**
         * Detect brute force attack patterns
         */
        
        const loginFailures = events.filter(e => e.type === 'login_failed');
        
        // Group by IP address
        const failuresByIP = new Map();
        
        for (const event of loginFailures) {
            const ip = event.data.ipAddress;
            if (!failuresByIP.has(ip)) {
                failuresByIP.set(ip, []);
            }
            failuresByIP.get(ip).push(event);
        }
        
        // Check for brute force patterns
        const bruteForceIPs = [];
        
        for (const [ip, failures] of failuresByIP) {
            if (failures.length >= this.config.maxFailedLogins) {
                bruteForceIPs.push({
                    ip: ip,
                    attempts: failures.length,
                    timespan: this.calculateTimespan(failures),
                    targetedUsers: [...new Set(failures.map(f => f.data.userId))]
                });
            }
        }
        
        return {
            detected: bruteForceIPs.length > 0,
            type: 'brute_force_attack',
            severity: 'high',
            details: {
                attackingIPs: bruteForceIPs,
                totalAttempts: loginFailures.length
            }
        };
    }
    
    async handleThreatPattern(pattern) {
        /**
         * Handle detected threat pattern
         */
        
        const threatId = crypto.randomUUID();
        
        console.log(`🚨 Threat pattern detected: ${pattern.type} (${threatId})`);
        
        // Store active threat
        this.activeThreats.set(threatId, {
            id: threatId,
            type: pattern.type,
            severity: pattern.severity,
            detected_at: new Date().toISOString(),
            details: pattern.details,
            status: 'active',
            mitigation_actions: []
        });
        
        // Take automated mitigation actions
        const mitigationActions = await this.performAutomatedMitigation(pattern);
        
        // Send security alert
        await this.sendSecurityAlert(threatId, pattern, mitigationActions);
        
        // Update threat with mitigation actions
        const threat = this.activeThreats.get(threatId);
        threat.mitigation_actions = mitigationActions;
        threat.last_updated = new Date().toISOString();
    }
    
    async performAutomatedMitigation(pattern) {
        /**
         * Perform automated mitigation actions for detected threats
         */
        
        const actions = [];
        
        try {
            switch (pattern.type) {
                case 'brute_force_attack':
                    // Block attacking IP addresses
                    for (const attackData of pattern.details.attackingIPs) {
                        await this.blockIPAddress(attackData.ip, 'brute_force_attack');
                        actions.push(`Blocked IP: ${attackData.ip}`);
                    }
                    break;
                    
                case 'api_abuse':
                    // Implement rate limiting
                    await this.enforceStrictRateLimit(pattern.details.abuser);
                    actions.push(`Strict rate limiting applied to: ${pattern.details.abuser}`);
                    break;
                    
                case 'data_exfiltration':
                    // Temporarily disable data export features
                    await this.disableDataExport();
                    actions.push('Data export features temporarily disabled');
                    break;
                    
                default:
                    actions.push('No automated mitigation available');
            }
            
            console.log(`🛡️ Automated mitigation completed: ${actions.length} actions taken`);
            
        } catch (error) {
            console.error('❌ Automated mitigation failed:', error);
            actions.push(`Mitigation failed: ${error.message}`);
        }
        
        return actions;
    }
}

Threat Monitoring Explanation:

Real-Time Analysis: Events are analyzed continuously to detect attack patterns as they develop, not just after they're complete.

Behavioral Tracking: The system learns normal user and IP behavior patterns, making it easier to detect anomalies.

Automated Mitigation: When threats are detected, the system can automatically take protective actions like blocking IPs or disabling features.

Pattern Recognition: Different attack types have different signatures - the system recognizes these patterns and responds appropriately.

---

Step 4: Compliance and Audit Reporting

Many organizations require formal security audits and compliance reporting.

Compliance Reporting Framework

// security/compliance-reporter.js

class ComplianceReporter {
    constructor(config = {}) {
        this.config = {
            // Compliance frameworks
            frameworks: config.frameworks || ['SOC2', 'GDPR'],
            reportingPeriod: config.reportingPeriod || 'monthly',
            
            // Report settings
            reportPath: config.reportPath || './compliance-reports',
            includeRemediation: config.includeRemediation !== false,
            
            // Stakeholder notifications
            stakeholderEmails: config.stakeholderEmails || [],
            executiveSummary: config.executiveSummary !== false
        };
        
        // Compliance tracking
        this.complianceMetrics = new Map();
        this.auditTrail = [];
        
        console.log('✅ Compliance reporter initialized');
    }
    
    async generateComplianceReport(framework, period) {
        /**
         * Generate comprehensive compliance report
         * 
         * Args:
         *   framework: Compliance framework (SOC2, GDPR, HIPAA, etc.)
         *   period: Reporting period (monthly, quarterly, annual)
         */
        
        console.log(`📋 Generating ${framework} compliance report for ${period}...`);
        
        const reportId = crypto.randomUUID();
        const startTime = Date.now();
        
        const report = {
            reportId: reportId,
            framework: framework,
            period: period,
            generatedAt: new Date().toISOString(),
            
            // Report sections
            executiveSummary: {},
            securityControls: {},
            vulnerabilityAssessment: {},
            incidentSummary: {},
            remediationPlan: {},
            
            // Compliance status
            overallCompliance: 'unknown',
            controlsAssessed: 0,
            controlsPassing: 0,
            criticalFindings: 0
        };
        
        try {
            // Generate framework-specific report sections
            switch (framework.toLowerCase()) {
                case 'soc2':
                    await this.generateSOC2Report(report);
                    break;
                case 'gdpr':
                    await this.generateGDPRReport(report);
                    break;
                case 'hipaa':
                    await this.generateHIPAAReport(report);
                    break;
                default:
                    await this.generateGenericSecurityReport(report);
            }
            
            // Calculate overall compliance
            report.overallCompliance = this.calculateOverallCompliance(report);
            
            // Generate executive summary
            report.executiveSummary = this.generateExecutiveSummary(report);
            
            // Save report
            await this.saveComplianceReport(report);
            
            // Send notifications
            if (report.criticalFindings > 0) {
                await this.sendCriticalFindingsAlert(report);
            }
            
            console.log(`✅ Compliance report generated: ${reportId}`);
            console.log(`   Overall compliance: ${report.overallCompliance}`);
            console.log(`   Controls passing: ${report.controlsPassing}/${report.controlsAssessed}`);
            console.log(`   Critical findings: ${report.criticalFindings}`);
            
            return report;
            
        } catch (error) {
            console.error(`❌ Compliance report generation failed:`, error);
            throw error;
        }
    }
    
    async generateSOC2Report(report) {
        /**
         * Generate SOC 2 Type II compliance report
         */
        
        const