Topic starter
24/09/2026 1:27 pm
TL;DR: Many SOC 2 buyers still judge vendors on badges, speed, and price while missing the control quality that determines whether evidence is trustworthy, whether findings are real, and whether post-audit security stays active, according to Oneleet. The deeper issue is that compliance workflows can certify paperwork faster than they can prove resilience, which leaves buyers exposed to security theatre.
NHIMG editorial — based on content published by Oneleet: 10 Questions to Ask SOC 2 Vendors Before You Sign
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when a SOC 2 programme measures evidence quality too loosely?
A: The programme starts rewarding artefacts instead of outcomes.
Q: Why do weak compliance controls create commercial risk as well as security risk?
A: Because enterprise buyers often re-check the substance behind the report during procurement or renewal.
Q: How do you know if a pentest report is actually useful?
A: A useful report turns findings into prioritised actions, explains exploitability in plain terms, and supports both remediation planning and leadership reporting.
Practitioner guidance
- Validate evidence before auditor submission Create a pre-audit review step that checks whether each control artifact actually supports the claim being made, especially for pentest reports, access evidence, and remediation records.
- Separate control presence from control effectiveness Track whether a safeguard exists and whether it is working, then report both.
- Demand independent testing quality criteria Ask vendors to show how they measure signal quality, false positives, retest terms, and remediation guidance.
What's in the full article
Oneleet's full blog covers the operational detail this post intentionally leaves for the source:
- The vendor's question set for comparing pentest quality, auditor independence, and evidence validation in practice.
- The specific red flags it uses to separate real security signal from compliance theatre during vendor selection.
- The full discussion of pricing, scoping, and hidden add-ons that affect compliance programme cost over time.
- The detailed examples of what buyers should ask before signing a SOC 2 vendor contract.
👉 Read Oneleet's 10 questions for choosing a SOC 2 vendor →
SOC 2 vendor security theater: what buyers should test first?
Explore further
24/09/2026 1:27 pm
Security theatre is a control governance problem, not a marketing problem. When buyers accept compliance output as evidence of security quality, they create an assurance gap that adversaries do not respect. The relevant question is whether controls are measurable, repeatable, and independently verifiable, not whether a dashboard is green. That is why identity and access evidence must be tied to actual lifecycle control, not ceremonial documentation.
A question worth separating out:
Q: How can organisations tell whether post-audit monitoring is really active?
A: Check whether the programme continues to track unresolved findings, environment drift, and control decay after the report is issued. If monitoring stops at the moment compliance is achieved, the organisation has an attestation process, not an active security process. That distinction matters most when access and configuration change continuously.
👉 Read our full editorial: SOC 2 vendor due diligence is still being gamed by theatre
