If your goal is to maximize your posture against cyber threats, spending your time on SOC 2 compliance with Vanta (or similar) is a waste of time if you consider the amount of time spent compared to security gained.

It's incredibly easy to get SOC 2 audited and still have terrible security.

> forces you to go through a very useful exercise of risk modeling

Have you actually done this in Vanta, though? You would have to go out of your way to do it in a manner that actually adds significant value to your security posture.

(I don't think SOC/ISO are a waste of time. We do it at our company, but for reasons that have nothing to do with security)