Trust is invisible.

A company hands its customer data to a vendor it met three weeks ago. A contract gets signed on the assumption that the other side patches its servers, screens its engineers, and notices when something breaks. None of that is visible from the outside.

Assurance exists to close that gap. Someone independent looks at what a company actually does, tests it against a published standard, and reports what they found.

The value was never the document. It was that a person with a license and a reputation put their name on the conclusion, knowing what happens if it turns out to be wrong. That idea is old, and it still works. What broke is the practice that grew around it.

Compliance became theater.

The industry got very good at looking secure. Policies are written and never read. Controls are described rather than operated. Evidence is assembled for the audit and abandoned the day after it ends.

The paperwork moves and the risk stays exactly where it was. It survives because it pays on both sides. The buyer needs a document to clear procurement. The seller needs the deal to close. The examination in the middle quietly became the least important part of the transaction.

In 2026 a venture funded compliance company was reported to have issued hundreds of fabricated reports. That was the extreme version, and it made the news. The ordinary version is quieter. A real examination, performed thinly, that nobody reads closely enough to question.

When a report stops carrying information, buyers stop believing the category, and the cost of that lands on every company that did the work properly.

Audit is a craft.

What separates an examination from a formality is not the length of the report. It is whether the testing could have failed. Whether the sample came from the full population or from whatever was easy to export. Whether the evidence shows a control operating or shows somebody describing it. Whether a finding still gets written down at the point in the schedule where writing it down is inconvenient.

None of that judgment lives in the standards. It is learned by doing the work next to people who have done it for a long time, on engagements where the answer mattered to somebody.

That grounding came from one of the Big Four. Our founder spent those years leading more than thirty SOC 2 engagements across the United States and Canada, on teams serving companies including LinkedIn, Ripple, and Affirm, and taught the methodology to other auditors firmwide.

The standard carried over. The machinery that existed to protect the firm rather than the client did not.

The builders changed.

A company shipping today is often two or three people and a set of agents. The code is written in Claude Code, Cursor, or Codex, reviewed by one human, and deployed the same afternoon. Infrastructure is a Terraform file. The product itself is usually an AI product, which means it holds customer data on day one.

That team meets its first enterprise buyer at month six instead of year three, because AI let them build something credible that fast. The security questionnaire arrives before they have a security team, a compliance hire, or anyone with time to spend four months collecting screenshots.

They are also unusually well documented by default. Cloud configuration, identity policies, pull request history, deploy logs, and CI output all exist already, in a form more reliable than any screenshot a person could paste into a spreadsheet.

So the audit runs through the tools they already use. Their own AI reads their own systems, a person approves every step, and nothing leaves that they did not choose to send. The examiner evaluates what arrives.

AI collapsed the cost of gathering evidence. It did not collapse the value of an opinion, and the two should never be confused. Evidence can be continuous. An opinion is always bound to a period, and signing one stays a human act.