7 ms·

For anyone unaware, a SOC3 is just a SOC2 with the audit details removed - it includes a high level statement from the company (Apple) and from the auditor (EY)

For anyone unaware, a SOC3 is just a SOC2 with the audit details removed - it includes a high level statement from the company (Apple) and from the auditor (EY), that's it. Also Apple certainly does invest heavily in security and privacy but SOC2's are so commoditized that it's like saying "look I can afford 50k", it's not particularly interesting

datakan 2mo ago
Everyone lies on SOC2. Auditors don't understand the technologies and just take peoples word for it. It's a shit practice
- paulryanrogers 2mo ago
  Citation needed. This is not my experience at all, after participating in such efforts at three different companies.
  - datakan 2mo ago
    I'll just cite my 30 years in IT/InfoSec. Believe it or not, I really don't give a damn. It's common knowledge int he field regardless of what your experience is.
    - paulryanrogers 2mo ago
      Can you name the names of SOC auditors that are rubber stamping? Or point me to some public critiques within the industry?
      - an0malous 2mo ago
        Wasn’t that YC startup Delve doing exactly this? https://www.iansresearch.com/resources/all-blogs/post/security-blog/2026/04/19/delve-allegations-expose-weak-points-in-modern-compliance https://www.iansresearch.com/resources/all-blogs/post/securi...
        paulryanrogers 2mo ago
        That I'm familiar with. Is it part of a trend or just one bad apple?
  - tptacek 2mo ago
    I wouldn't put it the way they did but they're directionally sane about this. I would worry a lot more about someone repping their SOC2 as important or meaningful than I would worry about someone who was cynical about SOC2. (I don't mean Apple; Apple spends more on security than almost any firm in the world.) https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves/ https://fly.io/blog/soc2-the-screenshots-will-continue-until...
    - xocnad 2mo ago
      My experience with pen tests that you put above or on par with SOC2 Type 2 security mirrors the discussion here. It all comes down to the reputation of the firm doing the testing.
Terretta 2mo ago
Importantly, anyone can get SOC2 (Type 1) by claiming some controls they figure they'll look at themselves. SOC2 (Type 2) in theory requires an audit that you're actually doing what you said you'd do in (Type 1). Both may also allow general lag time. Note that firms decide on their own which controls to include, meaning, they get to decide to include or exclude various controls, the audit is on only the ones they picked. Pick basic controls, it's cheaper to pass easily, and now you have a logo. This means SOC2s of either type cannot be compared to one another (and SOC2 Type 1 are roughly logo-ware). SOC3 is, roughly, SOC2 redacted. Recap: SOC2 Type 1 is a firm picking some controls to say they'll do them, SOC2 Type 2 is roughly a firm having someone look at whether they're doing that (warning, screenshots might suffice, audit verification is probably not what you think), and SOC3 is public or non-confidential water down of that, typically without findings. The only thing that matters is what controls, specifically, they're actually audited on. So ideally you want to know what the controls they picked are, and that a SOC2 Type 2 was audited on those. Btw, keep in mind that "end to end encryption" means "https" and most controls have similarly basic ways of achieving them. It's difficult to fail SOC2 Type 2 core controls if you know "don't be useless" is how you pass them. Also, it's not $50K even through the big five DIY SOC2 Type 2 shops. You can use the same ones trillion dollar firms use, by signing up online, and you'll be surprised how inexpensive relative to the cost of failing to let a business check that box in their procurement process.
- FinnKuhn 2mo ago
  I think companies like Deel showed that SOC2 is more show than anything else. For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a-service https://deepdelver.substack.com/p/delve-fake-compliance-as-a...
  - paulryanrogers 2mo ago
    Hasn't Deel been run out of business though? IME SOC2 is still quite involved for any company, especially smaller ones without specialized security personnel.
deepsun 2mo ago
> "look I can afford 50k" Oh no. Looks like you never went through SOC2. 1. No, it does not require 50k, an auditor can cost way less (10k? maybe even less). 2. But the process of preparing for the audit will take a lot of work securing your systems (and increasing reliability and privacy as well), as long as you take it seriously. Of course you can lie to the auditor, but it's up on you. And auditor -- they might lose their CPA license and go to prison. Their job is to catch your lies. Source -- went through it, and took it seriously. It really did increase our security stance, even though we thought we were good at it.
- bayesnet 2mo ago
  That auditors are responsible for catching the lies of an audited company on penalty of being suspended is a position that the big audit firms would not agree with. They might agree that they are responsible for ensuring the material accuracy of accounts if fraud occurs, but even here EY has disclaimed responsibility if the fraud were sufficiently complex [0]. Indeed auditors lobbied very hard against being mandated with a broader anti-fraud role [1]. Admittedly this is on the "real" audit side and not the advisory/consulting side, which would be the ones to handle SOC I imagine, but nonetheless a position I find a bit absurd. [0]: https://www.ft.com/content/a9deb987-df70-4a72-bd41-47ed8942e83b https://www.ft.com/content/a9deb987-df70-4a72-bd41-47ed8942e...? [1]: https://www.ft.com/content/c25de9fb-a808-4946-ade6-80d76a66a311 https://www.ft.com/content/c25de9fb-a808-4946-ade6-80d76a66a...
  - FireBeyond 2mo ago
    > Admittedly this is on the "real" audit side and not the advisory/consulting side, which would be the ones to handle SOC I imagine, but nonetheless a position I find a bit absurd. I mean, it's not like the supposed "Chinese wall" at the Big 4 has ever been accused of being "illusory" on multiple occasions.
- tptacek 2mo ago
  I co-ran a business with a significant SOC2 practice (we ran security programs for startups), and then oversaw Fly.io's SOC2 Type 2. The person you're responding to is more right than you are, and I would push back in a variety of ways on your point (2).
shye 2mo ago
Last I chatted with some friends who were going through their first SOC2, they quoted a much lower number.
- sethhochberg 2mo ago
  The details people gloss over when throwing SOC 2 or whatever other audit costs around are the complexity of the system being audited, the chosen criteria to audit (AICPA defines 5 families of criteria... Security is one, but you can optionally add Processing Integrity, Confidentiality, etc etc) and the reputation of the auditor. A security-only audit for a small company with a narrow product focus can indeed be very inexpensive. A full SOC 2 examination for a large organization with a mix of legacy and modern systems by a name-recognizable public accounting firm can be many hundreds of thousands of dollars, or more if you need a Big 4 firm. In my opinion, there's not much value to the "cheap" audits... If you're doing enterprise sales to a certain kind of client, your partners who demand an audit are going to want a reputable auditor or they're just going to put you through their own in-depth procurement due diligence regardless. The segment of the industry where a SOC 2 attestation is mandatory to participate but where any random auditor will do feels pretty narrow.
  - tptacek 2mo ago
    Unless you have a very good reason (I compare notes with people at dozens of firms and have never heard one), the only criteria you ever want to get SOC2'd on is Security. My experience is the opposite of yours: having a security SOC2 ends the vendorsec process it any enterprise buyer, and enterprise buyers virtually never read anything in the SOC2 other than a glance at the exceptions. A very large, very security-intensive vendor we have all heard of told me a story about a vendor they had that gave them several years of repeated Type 1 reports. Went fine.
- tptacek 2mo ago
  You can get a SOC2 done for mid to mid-high thousands.
tptacek 2mo ago
(Specifically: the SOC3 is a public report; the SOC2 report generally isn't supposed to be handed out except to named clients under contract. You pay extra to get the auditors to give you a report you can just stick on a website.)

datakan 2mo ago

Everyone lies on SOC2. Auditors don't understand the technologies and just take peoples word for it. It's a shit practice

paulryanrogers 2mo ago
Citation needed. This is not my experience at all, after participating in such efforts at three different companies.
- datakan 2mo ago
  I'll just cite my 30 years in IT/InfoSec. Believe it or not, I really don't give a damn. It's common knowledge int he field regardless of what your experience is.
  - paulryanrogers 2mo ago
    Can you name the names of SOC auditors that are rubber stamping? Or point me to some public critiques within the industry?
    - an0malous 2mo ago
      Wasn’t that YC startup Delve doing exactly this? https://www.iansresearch.com/resources/all-blogs/post/security-blog/2026/04/19/delve-allegations-expose-weak-points-in-modern-compliance https://www.iansresearch.com/resources/all-blogs/post/securi...
      - paulryanrogers 2mo ago
        That I'm familiar with. Is it part of a trend or just one bad apple?
- tptacek 2mo ago
  I wouldn't put it the way they did but they're directionally sane about this. I would worry a lot more about someone repping their SOC2 as important or meaningful than I would worry about someone who was cynical about SOC2. (I don't mean Apple; Apple spends more on security than almost any firm in the world.) https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves/ https://fly.io/blog/soc2-the-screenshots-will-continue-until...
  - xocnad 2mo ago
    My experience with pen tests that you put above or on par with SOC2 Type 2 security mirrors the discussion here. It all comes down to the reputation of the firm doing the testing.

Terretta 2mo ago

Importantly, anyone can get SOC2 (Type 1) by claiming some controls they figure they'll look at themselves. SOC2 (Type 2) in theory requires an audit that you're actually doing what you said you'd do in (Type 1). Both may also allow general lag time. Note that firms decide on their own which controls to include, meaning, they get to decide to include or exclude various controls, the audit is on only the ones they picked. Pick basic controls, it's cheaper to pass easily, and now you have a logo. This means SOC2s of either type cannot be compared to one another (and SOC2 Type 1 are roughly logo-ware). SOC3 is, roughly, SOC2 redacted. Recap: SOC2 Type 1 is a firm picking some controls to say they'll do them, SOC2 Type 2 is roughly a firm having someone look at whether they're doing that (warning, screenshots might suffice, audit verification is probably not what you think), and SOC3 is public or non-confidential water down of that, typically without findings. The only thing that matters is what controls, specifically, they're actually audited on. So ideally you want to know what the controls they picked are, and that a SOC2 Type 2 was audited on those. Btw, keep in mind that "end to end encryption" means "https" and most controls have similarly basic ways of achieving them. It's difficult to fail SOC2 Type 2 core controls if you know "don't be useless" is how you pass them. Also, it's not $50K even through the big five DIY SOC2 Type 2 shops. You can use the same ones trillion dollar firms use, by signing up online, and you'll be surprised how inexpensive relative to the cost of failing to let a business check that box in their procurement process.

FinnKuhn 2mo ago
I think companies like Deel showed that SOC2 is more show than anything else. For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a-service https://deepdelver.substack.com/p/delve-fake-compliance-as-a...
- paulryanrogers 2mo ago
  Hasn't Deel been run out of business though? IME SOC2 is still quite involved for any company, especially smaller ones without specialized security personnel.

deepsun 2mo ago

> "look I can afford 50k" Oh no. Looks like you never went through SOC2. 1. No, it does not require 50k, an auditor can cost way less (10k? maybe even less). 2. But the process of preparing for the audit will take a lot of work securing your systems (and increasing reliability and privacy as well), as long as you take it seriously. Of course you can lie to the auditor, but it's up on you. And auditor -- they might lose their CPA license and go to prison. Their job is to catch your lies. Source -- went through it, and took it seriously. It really did increase our security stance, even though we thought we were good at it.

bayesnet 2mo ago
That auditors are responsible for catching the lies of an audited company on penalty of being suspended is a position that the big audit firms would not agree with. They might agree that they are responsible for ensuring the material accuracy of accounts if fraud occurs, but even here EY has disclaimed responsibility if the fraud were sufficiently complex [0]. Indeed auditors lobbied very hard against being mandated with a broader anti-fraud role [1]. Admittedly this is on the "real" audit side and not the advisory/consulting side, which would be the ones to handle SOC I imagine, but nonetheless a position I find a bit absurd. [0]: https://www.ft.com/content/a9deb987-df70-4a72-bd41-47ed8942e83b https://www.ft.com/content/a9deb987-df70-4a72-bd41-47ed8942e...? [1]: https://www.ft.com/content/c25de9fb-a808-4946-ade6-80d76a66a311 https://www.ft.com/content/c25de9fb-a808-4946-ade6-80d76a66a...
- FireBeyond 2mo ago
  > Admittedly this is on the "real" audit side and not the advisory/consulting side, which would be the ones to handle SOC I imagine, but nonetheless a position I find a bit absurd. I mean, it's not like the supposed "Chinese wall" at the Big 4 has ever been accused of being "illusory" on multiple occasions.
tptacek 2mo ago
I co-ran a business with a significant SOC2 practice (we ran security programs for startups), and then oversaw Fly.io's SOC2 Type 2. The person you're responding to is more right than you are, and I would push back in a variety of ways on your point (2).

shye 2mo ago

Last I chatted with some friends who were going through their first SOC2, they quoted a much lower number.

sethhochberg 2mo ago
The details people gloss over when throwing SOC 2 or whatever other audit costs around are the complexity of the system being audited, the chosen criteria to audit (AICPA defines 5 families of criteria... Security is one, but you can optionally add Processing Integrity, Confidentiality, etc etc) and the reputation of the auditor. A security-only audit for a small company with a narrow product focus can indeed be very inexpensive. A full SOC 2 examination for a large organization with a mix of legacy and modern systems by a name-recognizable public accounting firm can be many hundreds of thousands of dollars, or more if you need a Big 4 firm. In my opinion, there's not much value to the "cheap" audits... If you're doing enterprise sales to a certain kind of client, your partners who demand an audit are going to want a reputable auditor or they're just going to put you through their own in-depth procurement due diligence regardless. The segment of the industry where a SOC 2 attestation is mandatory to participate but where any random auditor will do feels pretty narrow.
- tptacek 2mo ago
  Unless you have a very good reason (I compare notes with people at dozens of firms and have never heard one), the only criteria you ever want to get SOC2'd on is Security. My experience is the opposite of yours: having a security SOC2 ends the vendorsec process it any enterprise buyer, and enterprise buyers virtually never read anything in the SOC2 other than a glance at the exceptions. A very large, very security-intensive vendor we have all heard of told me a story about a vendor they had that gave them several years of repeated Type 1 reports. Went fine.
tptacek 2mo ago
You can get a SOC2 done for mid to mid-high thousands.

tptacek 2mo ago

(Specifically: the SOC3 is a public report; the SOC2 report generally isn't supposed to be handed out except to named clients under contract. You pay extra to get the auditors to give you a report you can just stick on a website.)