James Flynn

Over the last few days, there’s been a lot of discussion in Compliance Land about audit quality and what “trust” really means in practice. I want to be clear: Vanta is not involved in these practices or associated with the firms in question. The behaviors discussed represent a fundamental misunderstanding of what we are all here to do. Trust isn't a badge to buy; it's a standard to maintain. When we started Vanta in 2018, the goal was simple: help startups earn trust early so they could compete for larger customers. At the time, a SOC 2 report was often treated as the finish line. If you had the report, the conversation moved on. That’s no longer how trust works; nor should it work that way. A SOC 2 report is a snapshot. Snapshots only matter if they’re accurate, independently verified, and grounded in how systems actually work, and even then, they're just snapshots. At Vanta, we’ve always believed that security and compliance should be two sides of the same coin. You shouldn’t “check the box” one way and secure your systems another. You should secure them and then let software prove that continuously. That belief shapes how we think about audit integrity. We don't issue reports. Independent auditors do. Today, tens of thousands of audits have been completed using Vanta. We maintain a network of more than 100 vetted, independent audit firms around the world that conduct audits using Vanta, and all of the auditors we introduce to our customers are AICPA peer reviewed, which is a baseline requirement for audit quality and independence. Independence and rigor really matter here. Automation should make audits faster, but the goal is better audits, not just faster ones. At the same time, the answer to audit cheat codes isn’t going backward to slower, more manual processes. The real improvement comes from knowing, day to day, whether your controls are actually working, instead of finding out months later during an audit. SOC 2 still matters. It’s just not the whole story. If you’re building or buying software today, trust increasingly comes from how well your controls hold up over time *and* from who’s actually validating them.