I don't think it's on people in your position to solve this issue, but I do think it's important for people in your role to understand it and try to help by acc

I don't think it's on people in your position to solve this issue, but I do think it's important for people in your role to understand it and try to help by accommodating security solutions that are not "pay exorbitant fees to known security vendors." For instance, the industry desperately needs nearly free, open security tools, that are also going to be accepted by people in your role. Too often open source solutions are immediately dismissed by compliance people simply because they are unfamiliar, or because they don't believe open source can be as good, or in the worst case because of propaganda against open source by security tool vendors. Similarly we need free starter packages and standard templates for processes that small companies can use to get SOC2 equivalent process in practice, without paying hundreds of thousands a year to expensive auditors. Maybe there should also be a push on vendors not to use SOC2 related security features as an enterprise tier gate. E.g. SAML or SSO is often only available on "you can't afford it" enterprise tier. There is a lot we can do to fix these problems, but we need people to care, including people in your role.