Security audits are just theater. If they were not, you could not ever convince them that using a platform feeding unlicensed source (including apparently from private repositories) to their commercial LLM is ever a pass.
ISO cert compatibility audits are very different from a proper security audit.
And weather they do anything to check if depends on which you high, many of the slightly more expensive ones have the reputation to be "fast" and "overlook most issues".
But that doesn't apply to all security audits (but most audits for ISO compatibility, like really it's bad).
Anyway see my way to long answer about the on a sibling comment.
It really depends on you auditor, audit approach and goals.
There are many audit companies which have a "under the hand" reputation of not properly looking and being easy to convince that you are secure, naturally at a above average audit cost (same but worse btw. for certificates showing compatibility with industry standards).
So if the audit was paid for by the company themself you can't trust it at all (which doesn't mean the company wanted to hide anything, this "bad" audit companies also tend finish the audit fast. So sometimes companies go for it, even if they don't have anything to hide).
Similar sometimes audit companies ask if they can audit you, this is for boosting their publicity using your name. This can easily turn into a "one hand washes the other" situation where they won't overlook massive issues, but still judge issues leniently.
Lastly there are some automated partial audit services which scan you public APIs/websites etc. Realistically they tend to be kinda dump, and might tell you they find a medium issue because (no joke) your REST API allows PUT and DELETE (1). Still I now take them a bit more serious after they pointed out, that there was a configuration error of a web gateway leading to some missing security headers.
(1: There is some history behind that, it's still dump for 90% of REST APIs)
Anyway, the situations so far are security audits which are at least 50% theater. BUT if a huge customers fully pays a audit company with a good/strict reputation then it often really isn't a security theater and can be quite a bad surprise if you company isn't prepared (because you have to fix so much). Like such reviews tend to not only be focused at your deployment or code but the whole software live cycle, including fun questions like "what measurements have you taken in case one of your developers tries to inject a supply chain attack" (which to be clear don't need to have perfect answers, just good enough, and most importantly clear and well documented).
https://www.copilot.live/blog/does-github-copilot-use-your-c...
yes, what i said
https://docs.github.com/en/site-policy/github-terms/github-t...
(The link I posted is also not the proper ToS, it is more of an abridged version. They made the actual ToS somewhat hard to find and I cannot be bothered.)
> Short version: We treat the content of private repositories as confidential, and we only access it as described in our Privacy Statement—for security purposes, to assist the repository owner with a support matter, to maintain the integrity of the Service, to comply with our legal obligations, if we have reason to believe the contents are in violation of the law, or with your consent.
> You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time.
> parse it into a search index or otherwise analyze it on our servers
This is an “AI” platform now. “Improving the service” means that. “With your consent” means you have accepted the ToS (which by the way can be changed at any point and your continued use of the service means you consent to it).