Here here. The only thing SOC2 has done in my opinion is to create a multibillion dollar business that mainly just drains resources from companies that may not have them, with no guarantees you're actually secure. This usually devolves into security theatre where the CISO and underlings are putting in tools that drown teams with so much noise it's hard to detect the signal.
The people running these programs rarely understand the security space well enough to even tell you what a lot of the hits even mean, which ramps up disdain and division between the groups. This is arguably more detrimental to security as the scanners give execs/management a false sense of security while the noise makes it incredibly difficult to run a holistic security strategy.
The people running these programs rarely understand the security space well enough to even tell you what a lot of the hits even mean, which ramps up disdain and division between the groups. This is arguably more detrimental to security as the scanners give execs/management a false sense of security while the noise makes it incredibly difficult to run a holistic security strategy.