Given the huge amount of work that goes into something like a SOC 2 audit, I'm just curious if there is any data that this process actually improves security. For example, some of the largest security breaches in recent history, like the supply chain attacks with SolarWinds, were in part due to following "best practices" required by things like SOC 2. Plenty of the items in SOC 2 seem like good recommendations, but there is a ton of "box-ticking". I'm just curious if there have ever been any studies on SOC 2 audits, for example are data breaches less likely to occur in audited companies.