Most of what gets written about SOC 2 is aimed at people dealing with it for the first time. Founders facing their first audit. Buyers learning what to ask for. Vendors trying to get through a procurement review. That advice skips over the teams who actually live with SOC 2 year after year: the practitioners collecting evidence, testing controls, and answering security questionnaires on a random Tuesday afternoon.
Our new report, SOC 2 By the Numbers, was designed for that group. Instead of trading opinions, we looked at anonymized, aggregated data across the Drata customer base to see how organizations are approaching SOC 2 right now: where adoption is growing, how long readiness actually takes, what teams build after their first report, and which behaviors separate the programs that scale from the ones that stall.
SOC 2 Has Become the Default Starting Point
Roughly 70% of Drata customers have SOC 2. That single number says a lot about how the framework functions today. For modern B2B companies, SOC 2 is the first framework deployed, the one that never fully closes, and the foundation every other standard gets mapped back to.
Adoption is strongest in the Americas, where security and procurement teams often ask for a SOC 2 report early in the deal cycle. It is highest in software and services, followed by professional services, financials, and other sectors where uptime and customer data sit at the center of the business. And it keeps climbing. New SOC 2 accounts have grown steadily quarter over quarter, with each wave of heightened vendor scrutiny and third-party risk regulation pulling more companies into the fold.
How to read: this is Drata's customer base, not the entire market. Our customers are already investing in compliance, so adoption and readiness run higher here than they would across companies in general. Treat the patterns as directional signals about how compliance-mature teams operate, rather than a census of the industry.
SOC 2 Pressure Now Reaches Small Teams Early
The old playbook said to wait for a Series A or a revenue threshold before pursuing SOC 2. The data says that plan leaves you behind the companies selling into your buyers right now.
Seed-stage and early-revenue companies run into SOC 2 questions the moment they handle sensitive data or target enterprise accounts. Buyers want an existing report or a credible plan and timeline to get one. So more teams bake SOC 2 into their go-to-market from the start, aligning security, product, and operations around a control set they know buyers will examine.
In our data, emerging companies with SOC 2 show higher readiness, deeper platform usage, and more active Trust Center adoption than peers at the same headcount without it. SOC 2 has become a baseline expectation even for the smallest teams.
Don't Assume Small Teams Are at a Disadvantage
A common assumption is that a small team starting from scratch faces a much longer road than a large, well-resourced one. But that’s not what the data shows.
Readiness patterns vary by segment, and bigger does not mean better positioned. Large enterprises carry more scope, more systems, and more stakeholders, which tends to cap how far a program gets and how often it reaches full readiness. Smaller teams cover less ground and frequently reach a strong readiness level, and they complete more often. Starting small does not put your program behind.
One thing worth being precise about: readiness is not the same as a finished report. Reaching high readiness in Drata means your controls are in place, your policies are documented, and your evidence is flowing. A SOC 2 Type II report, the standard most enterprise buyers ask for, also requires an observation period of roughly six to twelve months during which those controls run and get tested before an auditor can issue an opinion.
The clock on that observation period doesn’t start until you are ready. The earlier you build toward readiness, the sooner you can put a report in front of buyers. Treating SOC 2 as a project to do later delays the report and the clock behind it.
Your starting point matters as much as your size. Teams that arrive with real security hygiene already in place have less to build from scratch, so prior investment in fundamentals like access control, logging, and incident response pays off twice: a stronger risk posture on its own, and a head start toward a credible attestation.
Many "Not Yet" Companies Are Closer Than They Think
There is a sizable group of small and emerging customers in our data who do not have a SOC 2 report yet but appear ready. They show meaningful readiness scores, strong integration footprints, and real policy maturity.
The remaining gaps often include:
- Missing or incomplete policies, especially around governance, vendor risk, and incident response
- Evidence that teams produce day to day but never document or retain consistently
- Thin monitoring or vendor management, such as limited cloud visibility or inconsistent subprocessor reviews
For many of these teams, SOC 2 is within reach without a full re-architecture. The remaining work is a focused push: tighten documentation, connect key systems, close specific coverage gaps, and engage an independent auditor.
Integration Footprint Is the Clearest Signal of Maturity
The single best predictor of SOC 2 maturity in our data is how many systems a company connects. That factor comes ahead of company size, region, and industry.
SOC 2 customers integrate more tools than their peers: source control, cloud, identity, HR, collaboration, ticketing, and security platforms. GitHub, AWS, and Slack rank among the most common connections. Those integrations plug the real environment into the compliance program, which makes evidence collection more automated, keeps readiness scores fresh, and catches control drift earlier.
For small teams, integrations act as a force multiplier. Connecting a focused set of systems drives outsized gains in readiness and day-to-day visibility, and it keeps compliance tied to how the organization actually builds software instead of living in random folders or a pile of documents. For multi-framework teams, that same integration layer becomes leverage: build the pipelines once, then reuse them across SOC 2, ISO 27001, HIPAA, and PCI DSS by mapping shared controls to the same data.
Where Programs Struggle: Vulnerabilities and Configuration
Not every control area performs equally. A small set of tests shows consistently higher failure rates, and they concentrate around vulnerability remediation and production configuration hygiene.
The reason matches what practitioners see every day: writing a policy is easier than keeping technical signals current across fast-moving cloud and code environments. Teams that improve here usually tighten the loop between their scanning tools, their cloud and code systems, and how they track control performance over time.
What Comes After the First Report
SOC 2 rarely stays a solo act. Once teams land their first report, expansion follows industry logic. The frameworks most often adopted alongside SOC 2 are ISO 27001, HIPAA for health-adjacent companies, and GDPR or other privacy regimes.
Health tech pairs SOC 2 with HIPAA. Fintech and payments-adjacent providers add PCI DSS. Companies in ISO-first markets often lead with ISO 27001 and add SOC 2 to win U.S. deals, while U.S.-first vendors do the reverse when they expand globally. In every case, SOC 2 acts as the foundational layer, and mature teams converge on one shared control environment mapped to several standards rather than standing up a separate program for each.
What This Means for You
For emerging and small companies, SOC 2 is no longer a "someday" or future project. It unlocks enterprise deals and forces early clarity around access, change, incidents, and vendors. Start by inventorying your current controls, tools, and integrations, then find your policy, evidence, and monitoring gaps. You may be closer than you assume.
For scaling small and midsize business and mid-market teams, the risk is growth sitting on ad-hoc controls and shared drives. Use SOC 2 as the foundation to standardize an automated control environment with clear owners and a single system of record that supports multiple frameworks.
For large enterprises, the question moves from whether to pursue SOC 2 to how to harmonize frameworks, evidence, and reporting across the business. The biggest gains live at the intersections: aligning shared controls, rationalizing duplicate tests, and using signals from integrations and Trust Center activity to spot weak spots across business units.
A SOC 2 Report Is Just the Beginning
The data confirms what practitioners already know. SOC 2 runs on a cadence rather than ending at a finish line. There’s evidence to collect, controls to test, questionnaires to answer, frameworks to layer on as the business grows.
The teams that handle SOC 2 smoothly tend to share one trait: they built something they can sustain. Integrations over screenshots. Continuous monitoring over point-in-time scrambles. An independent audit partner who brings rigor.
Earn and Keep SOC 2 With Drata
The Drata Agentic Trust Management Platform helps you earn your SOC 2 faster and keep it current—with automated evidence collection, continuous control tests, integrated internal and third-party risk, and real-time assurance. Whether you're pursuing your first report or maintaining an established program, Drata frees your team to run the business while standing behind a credible report.
Get the full report to see every chart and segment breakdown, then book a demo to see how Drata can support your program.