First off, I am huge fan of greynoise! My experience is on the more practical side of things so I do get how compliance is bullshit. NIST CSF is another one. I

First off, I am huge fan of greynoise! My experience is on the more practical side of things so I do get how compliance is bullshit. NIST CSF is another one. I am used to dealing with stuff and I agree about the bullshit part but the author here misses the point of SOC2. Audits and compliance as well as 3rd party risk rating sites are not there to make sure the subject org is actually secure, their objective is to measure practices and hygeine. Maybe you will get ransomwared easily and your siem is shit. That's not the point, the point is if I do business with greynoise i did so after doing a reasonable amount of due dilligence and I know that their practices pass a smell test. That's it. This does create a perverse incentive! I find the core part of my work difficult to perform sometimes becuase I am going beyond any framework's mandate. And I have to figure out ways to show managers how it helps with compliance. I have been at orgs where everything is box checking. Forget a SIEM, just get an MSSP that can checm that and more boxes for you! I was getting told how I shouldn't collect logs because that would mean we's be responsible for catching hackers (no shit!) but instead to get a vendor. You have no idea how much I have to fight "just pay someone" for the sake if checking boxes and having someone to blame. And therein is the core problem: blame. That's it. Not just compliance auditing but getting consultants,etc... is all about blame, not security. This discussion has little to do with security, it's about covering asses. Ultimately, there are only few people that only care about security even in very large companies. And even then, their ability to protect the company depends on the chain of management they report to. In this case, given the author's frustrarion at SOC2, I say their company is in good hands. This is the right reaction to unanvoidable reality. I am more concerned about execs that consider SOC2 a sign of their awesome security or who call co sultants anytime they have security concerns. I loathe vendors who publish MITRE coverage for this reason as well. They don't even have categories in these frameworks that cover some of the critical security controls a modern org needs to take. Just pay someone, cover your ass and blame them when you get pwned. Welcome to infosec at most companies.