2018
Cacioppo estimated that global spending on SOC 2 in 2018 was about $10 million.
“if you looked at the SOC 2 market in 2018, my best estimate was there was $10 million spent globally and you would never start a startup on that.”
Topic
SOC 2
7 facts from 3 episodes, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
2018
Cacioppo said the market for startups obtaining SOC 2 reports in 2018 was effectively zero.
“The market for startups getting SOC 2 in 2018 was $0. Truly zero.”
Undated
Ben Mayrides predicts SOC 2 will add control criteria for AI agents within about a year and a half to two years.
“I can see us seeing a control criteria in SOC 2 within, like, say, the next year and a half, 2 years, uh, we need to be ready for that.”
Undated
Cacioppo said the policy goal of SOC 2 is to ensure customer data is protected.
“I would say it is trying to ensure customer data is protected.”
Undated
Cacioppo said that, unlike the PCI payment-card standard, SOC 2 has no prescribed list of controls, so companies must decide what the requirements mean for them.
“unlike PCI, SOC 2 doesn't have a prescribed control list. So PCI is kind of different, and it's like, you must buy this tool whether or not it's useful to you.”
Undated
Vendors commonly share SOC or ISO compliance reports so customers can judge whether the vendor meets the customer's own criteria.
“It's quite common for a vendor to, like, share their SOC report or whatever their ISO report so that you can take a look and say, well, it met their criteria, but does it meet our criteria?”
Undated
Craig Unger says a company pursuing SOC 2 compliance might have a couple hundred controls, some of which would be affected by AI.
“They might have a couple hundred controls. Just to give you a sense of scale for what it might take to become SOC compliant.”
Episodes
- 25 Mar 2026Governing AI Agents at Scale: Identity, Scope, and Observability (with Glean and Cvent) | CXOTalk #91429m
- 6 Nov 2026Building AI-Aware Controls for Enterprise Risk - with Craig Unger of Hyperproof26m
- 31 Mar 2026Compliance at scale and why TAM is a distraction with Christina Cacioppo of Vanta57m