RIP SOC 2. Oxy won't miss you.

When I wrote "RIP tech interviews," Reddit came for me, until Anthropic said the same thing. Saying no to SOC 2 will get us cut from some customer engagements. So be it. Every real shift starts out looking reckless to the people who are grading you on the B.C. era checklist.

Built for the last war

I've been wanting to write this post since July of this year.

I worked closely for two months in early 2025 integrating XetHub with the Hugging Face infrastructure team in Lyon. I know how seriously that team took security. They had done all the work the old playbook asked for. They were SOC 2 certified.

Photo with the HF infra team at my place in Seattle, taken on May 23, seven weeks before the OAI hack.

Then, in July, pre-release OpenAI models got out of what everyone thought was a secure sandbox and broke into Hugging Face. As MIT Technology Review put it, this was "the first time outside of a simulation that LLMs escaped what was thought to be a secure sandbox, accessed the open internet, and attacked another organization."

Think of the French Maginot Line, built after the First World War to fight that war again. When the Germans came, they didn't beat it with better weapons. They beat it by coordinating better.

AI Blitzkrieg. That is what's happening this month to software security. The bugs are the same kind of bugs we have always had. What's new is a tireless AI that coordinates better than humans.

Black October

The press is calling this month Black October. In the last few weeks we've heard about suspected North Korean hackers draining $6.3 billion from Binance in about 20 minutes, PHP2Shell, and a pile of leaked keys at AI developer platforms like OpenCode, Railway, and LiteLLM.

That's the public news. When I talk to friends inside large companies, the picture is far worse. At a big tech company I've worked at, the newest models found five serious remote code execution bugs in core infrastructure. At some of the largest US banks, it's all hands on deck. Vulnerabilities arrive by the hundreds and get fixed as they land.

I'm in the same boat as everyone else. My savings sit in the same banks and financial institutions as yours. There is no place anymore to hide.

This is the new normal

On May 5, Dario Amodei warned that there was a six- to 12-month window to patch tens of thousands of software vulnerabilities before AI catches up. We are inside that window now, and every software developer is feeling the heat.

What we are not doing

At SageOx, we are not planning on doing a SOC 2 audit. I did that at my previous two startups, TalentWorks and XetHub. We are not going to book an annual pentest. We are not starting a bug bounty program. We hear about far too many companies pursuing only rubber-stamped SOC 2 audits, or checking off an annual pentest, and then ignore the practical need for constant security analysis.

Much of this is vestigial today. Status quo maintenance. What Bruce Schneier calls security theater: "security measures that make people feel more secure without doing anything to actually improve their security."

A report about your security processes from a few months ago tells you nothing about the bug a model will find in your code tonight. AI already finds what a bounty would.

What we are doing at SageOx

This month, we changed how we build.

• AI agents focusing on the code. We're running the latest and best security skills against our codebase regularly.
• Constant security reviews. Open-source scanners plus AI reviewers, doing security deep dives into different aspects of our systems daily, weekly, and monthly.
• Security in the pipeline. We review the source code itself, not a running copy of the app, and scan main on a schedule. Findings become GitHub issues with an owner. That turns security testing into something every engineer at SageOx can do.
• Better tools. We're looking at Veria Labs, Claude Security, and Vercel's deepsec. We run Checkov on our infrastructure code.
• Dependencies kept current. Every dependency we rely on is going to have a ton of vulnerabilities exposed, so we keep updating all of them.

SOC 2 will be redefined in 2027

A new standard has to emerge soon. These two requirements are going to be table stakes:

• Real time. Auditors and customers will need to trust that security teams will be able to react to exploits in minutes and update patches in hours. They will expect a dashboard that shows whether a given patch has shipped.
• AI native. As and when vulnerabilities are disclosed, the patches have to roll to production at superhuman speeds.

There is a lot that is still unknown. As Gramsci put it, the old world is dying, and the new world struggles to be born.

What is clear to us is that it's not worth our time and attention to earn a certificate that guards against the last war.