SOC 2 vendor due diligence is still being gamed by theatre

At a glance

What this is: This article argues that SOC 2 due diligence is often gamed by compliance theatre, where vendors optimise for visible proof points instead of trustworthy security outcomes.

Why it matters: It matters because IAM, PAM, NHI, and broader security teams need to evaluate whether audit evidence, vulnerability testing, and remediation monitoring actually reflect control effectiveness.

Context

SOC 2 due diligence is not the same thing as security assurance. Buyers can be shown polished evidence, fast turnaround, and a clean badge while the underlying controls remain weak, inconsistently validated, or already stale. In that gap, compliance becomes a presentation layer rather than a governance signal.

The identity angle is indirect but real: the article highlights how enterprises rely on vendor attestations to trust access, testing, and remediation claims, which can include controls around accounts, systems, and security evidence. When vendors package governance as theatre, buyers inherit blind spots in third-party access and assurance models.

Key questions

Q: What breaks when SOC 2 evidence is collected without control closure?

A: Audit trails can show that actions happened, but they cannot prove the underlying access was appropriate, minimum necessary, or revoked on time. That creates a gap between documented activity and actual governance. The result is compliance theatre, where evidence looks complete even though lifecycle and privilege controls remain weak.

Q: Why do weak vendor security proofs create third-party risk for buyers?

A: Because the buyer inherits the decision to trust that proof. If a vendor’s pentest, remediation tracking, or audit evidence is thin, the buyer may sign based on false confidence and later discover the control gap during customer diligence or an incident review. That turns assurance quality into a procurement and risk issue.

Q: How do teams know whether their SOC 2 remediation plan is actually working?

A: Look for clear ownership, dated milestones, meeting notes, and proof that each gap was closed with evidence, not just intention. A working remediation plan should show that controls now operate consistently, stakeholders understand their responsibilities, and unresolved items are tracked transparently. If the same gaps reappear, the plan is not effective.

Q: Should security teams trust a SOC 2 badge or the underlying controls?

A: Trust the controls, not the badge. A badge only says an attestation happened, while real security depends on whether testing is credible, evidence is validated, and open findings are remediated on time. Buyers should use SOC 2 as a starting signal, then test for operational proof.

Technical breakdown

Why SOC 2 evidence quality breaks down in practice

SOC 2 is an attestation model, not a live technical certification, so evidence quality depends heavily on what the vendor submits and how it is validated before the auditor sees it. If a platform accepts weak, automated, or incomplete evidence, the audit can still pass because the auditor is assessing documentation against the report criteria, not re-performing security testing. That creates room for scanner output, generic reports, and narrow control proofs to masquerade as meaningful assurance.

Practical implication: Treat evidence validation as a control in its own right, not a clerical step.

Pentest signal quality versus scanner noise

A pentest is useful only when it produces findings that reflect real exploitability and material risk, not a long list of low-severity noise. The article distinguishes between vulnerability scans, automated testing, agentic or AI-assisted testing, and human-led testing, but the real issue is whether the result helps a buyer understand attackability. High signal testing is harder to fake, harder to automate blindly, and more defensible when a customer asks for proof.

Practical implication: Require proof that testing produces actionable findings, not just a completed assessment artifact.

How remediation gaps create a false compliance state

A platform can show 100% coverage while critical findings remain open if it tracks control presence but not remediation closure across the full lifecycle. That produces a dangerous mismatch between dashboard status and actual exposure, especially when SLA windows for critical, high, or medium findings are ignored after evidence collection ends. In governance terms, the problem is not only control design but control persistence after audit day.

Practical implication: Measure whether findings are closed on time, not just whether the control existed at submission.

NHI Mgmt Group analysis

Security theatre is a governance failure, not a marketing annoyance. When buyers accept badges as proof of security, they outsource assurance to presentation layers that can be gamed. The real failure is treating compliance evidence as if it were equivalent to control effectiveness. Practitioners should separate attestation from assurance and interrogate what the evidence actually proves.

Evidence quality is now a third-party risk issue. In vendor due diligence, a weak pentest or unvalidated submission does not stay inside the vendor's wall; it becomes part of the buyer's trust chain. That matters for procurement, security review, and renewal decisions because false confidence can delay remediation until the deal is already at risk. Buyers need to assess evidence provenance, not just evidence presence.

Continuous remediation visibility matters more than audit-day completeness. A SOC 2 program that only proves a control existed at one point in time can still leave open vulnerabilities in production. The better governance model is to treat open findings, remediation windows, and retest discipline as ongoing control evidence. That shifts the question from whether the audit passed to whether security stayed real after the report.

Trustworthy vendor assurance depends on proving the control, not the checkbox. The article exposes a wider market problem where buyers ask compliance vendors to certify security they never truly observe. That is especially relevant where third-party systems, accounts, and evidence pipelines sit outside the buyer's direct control. Practitioners should demand proof that the control is operational, repeatable, and independently defensible.

Control persistence is the named concept buyers should watch. Security does not end when the auditor signs off, and a dashboard that forgets open findings creates the illusion of maturity. The issue is not just whether a control existed, but whether it remained effective through remediation and retesting. Mature programmes should measure persistence, not just point-in-time compliance.

What this signals

Control persistence is the real buyer test. SOC 2 due diligence fails when teams assess a vendor at a single moment and ignore whether findings stay open or evidence stays credible after the report is issued. The practical shift is from asking whether a box was ticked to asking whether the control remained effective through remediation.

Evidence validation should sit inside the procurement workflow. Vendor security reviews are stronger when buyers force human validation of test reports, remediation status, and auditor independence before signature. That approach reduces the chance that a polished compliance story becomes the basis for an avoidable trust decision.

For practitioners

• Demand evidence provenance, not just evidence presence Require vendors to explain exactly how pentest reports, PDFs, and control artifacts are validated before submission to an auditor.
• Separate scanning from true pentesting Ask whether the test is scanner-driven, human-led, or hybrid, and reject reports that cannot show exploit-oriented findings or noise reduction.
• Verify independent auditor choice Insist on a shortlist of genuinely independent, AICPA-listed firms so the same party is not both selling the workflow and grading it.
• Track remediation closure after the audit Monitor whether critical, high, and medium findings are actually closed inside their remediation windows, not merely recorded as open tasks.
• Reprice the whole compliance journey Check whether retesting, vCISO support, and third-party audit fees are included across the full lifecycle, not only at onboarding.

Key takeaways

• SOC 2 theatre emerges when vendors optimise for visible compliance signals instead of verifiable control effectiveness.
• The strongest due diligence test is whether evidence is independently validated, tests are exploit-oriented, and remediation stays open only within defined windows.
• Buyers should treat audit-day completeness as insufficient and require proof that security persists after the report is issued.

Key terms

• Security Theater: Security theater describes a control that looks protective but adds little real security relative to its cost or risk. The term is used when a measure increases complexity, friction, or failure modes without materially changing the attacker’s position. In practice, it is a warning to test whether a control meaningfully reduces exposure.
• Evidence Provenance: The ability to trace a security conclusion back to the exact data, query, and control inputs that produced it. In AI-assisted operations, provenance is what makes an answer defensible, because speed without traceability creates reporting that is convenient but weak in audit, incident review, or privacy enforcement.
• Production remediation window: The production remediation window is the period between discovering a vulnerability and safely fixing it in a live environment. It matters because business uptime, testing, and change control often prevent immediate patching, leaving an opening that attackers can exploit.
• Audit-day completeness: Audit-day completeness is the false comfort of having every required artifact ready at the moment of attestation. It can hide whether controls are maintained before and after the audit, which is why it is a weak proxy for real security maturity.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps security and IAM practitioners build stronger control thinking across identity and access programmes.