As Ops person, massive doubt. I've been at companies that have gotten hacked twice now, neither my department though. Both times, security vulnerabilities that hackers got into were well known, the tickets were in the backlog and deprioritized over feature requests.

I've also seen cases where it's like, maybe we shouldn't share S3 Root Creds or put it on the VPC so we can monitor outgoing traffic but too many applications would need to be redeployed for that so skip it. Those 2 year old tickets were still sitting in the backlog when I left.

If we ever get report, it's extremely likely going to be massive failure and only way to change this is fines for company that are bankrupting.

EDIT: Oh yea, SOC2 needs to go away. It's security theater that's just giving cover to companies.