From a SOC 2 perspective, most breaches are not caused by a single failed technology. They typically result from breakdowns in access control, change and vulnerability management, monitoring, vendor oversight, and security awareness. The three most common root causes that management should focus on are: compromised credentials and social engineering; unpatched vulnerabilities and insecure system configurations; and third-party, cloud, and data governance weaknesses. Each of these areas maps directly to the Trust Services Criteria, particularly Security, Availability, Confidentiality, and, where applicable, Privacy.
1. Compromised Credentials, Phishing, and Weak Access Controls
Why this leads to breaches: Attackers frequently gain access through stolen usernames and passwords, phishing emails, business email compromise, password reuse, weak multi-factor authentication coverage, or excessive user privileges. Verizon’s 2024 Data Breach Investigations Report highlighted credentials and phishing as major breach entry points, and noted that a substantial majority of breaches involve a human element. Credential theft, phishing, and non-malicious human actions remain central breach drivers.
SOC 2 relevance: This issue primarily affects the Security category because unauthorized logical access can compromise systems and data. It may also affect Confidentiality and Privacy when the accessed systems contain confidential customer data or personal information.
Control considerations: Management should establish and operate controls addressing multi-factor authentication, password policies, single sign-on, privileged access reviews, timely user provisioning and deprovisioning, periodic access recertification, phishing awareness training, security event monitoring, and incident response procedures for suspected account compromise.
2. Unpatched Vulnerabilities and Insecure Configurations
Why this leads to breaches: Attackers commonly exploit known software vulnerabilities, internet-facing services, unsupported systems, weak network configurations, and cloud services that are not hardened. Verizon reported that exploitation of vulnerabilities as an initial access method increased significantly in 2024, with exploitation accounting for a meaningful portion of breaches and remediation often lagging patch availability. Delayed patching and vulnerability exploitation create a window attackers can use before organizations remediate critical issues. The CISA Known Exploited Vulnerabilities catalog is intended to help organizations prioritize vulnerabilities that are already being exploited in the wild. CISA identifies known exploited vulnerabilities as a key source for vulnerability management prioritization.
SOC 2 relevance: This area is closely tied to the Security and Availability categories. Poor patching, weak configuration baselines, and ineffective change management can allow unauthorized access, malware deployment, ransomware, service disruption, or loss of system integrity.
Control considerations: Management should maintain an asset inventory, perform authenticated vulnerability scanning, track remediation through defined service-level expectations, prioritize known exploited and critical vulnerabilities, review secure configuration baselines, monitor endpoint and network security alerts, and ensure emergency change procedures are available for critical fixes.
3. Third-Party, Cloud, and Data Governance Weaknesses
Why this leads to breaches: Organizations increasingly rely on cloud platforms, managed service providers, SaaS vendors, hosting providers, data processors, software suppliers, and integrated applications. Breaches can occur when vendors are compromised, when cloud permissions are overly broad, when data is stored in unmanaged environments, or when management lacks visibility into where sensitive data resides. IBM’s 2024 breach research noted that breaches involving data across multiple environments were more costly and took longer to identify and contain, and that shadow data and data visibility gaps remain prominent risk areas. Data spread across public cloud, private cloud, and on-premises environments can increase breach cost and containment difficulty.
SOC 2 relevance: This issue affects Security, Confidentiality, Availability, and Privacy depending on the nature of the outsourced service and the data processed. SOC 2 reports often require management to demonstrate that complementary subservice organization controls and complementary user entity controls are identified, communicated, and monitored.
Control considerations: Management should implement vendor risk management, obtain and review relevant SOC reports or security attestations, track vendor exceptions and corrective actions, classify and inventory sensitive data, enforce cloud security baselines, restrict administrative access to cloud resources, encrypt sensitive data, and monitor data movement across production, development, backup, and third-party environments.
SOC 2 Implications for Management
For SOC 2 purposes, management should be able to show that these risks are addressed through designed and operating controls, not merely policies. Evidence should demonstrate that controls operate consistently over the review period. Examples include access review completion records, vulnerability scan results and remediation tickets, phishing training completion, incident response testing, vendor review documentation, cloud configuration reviews, and monitoring alert investigations.
Recommended SOC 2 Control Focus Areas
- Access administration: Enforce MFA, least privilege, timely deprovisioning, privileged access monitoring, and recurring access reviews.
- Security awareness: Train personnel on phishing, credential protection, social engineering, incident reporting, and secure handling of confidential information.
- Vulnerability and patch management: Maintain asset inventories, scan routinely, assess severity, prioritize actively exploited vulnerabilities, and document remediation.
- Configuration and change management: Define secure baselines, approve and test changes, restrict emergency changes, and monitor deviations from approved configurations.
- Logging and monitoring: Centralize security logs, monitor authentication anomalies, investigate alerts, and retain evidence of incident triage.
- Vendor and cloud governance: Evaluate subservice organizations, review SOC reports, track user entity responsibilities, and monitor cloud access and data storage practices.
- Data protection: Classify sensitive data, encrypt data where appropriate, limit access to production data, and monitor data transfers and backups.
Conclusion
The top breach drivers from a SOC 2 perspective are failures in identity and access management, vulnerability and configuration management, and third-party or cloud data governance. A strong SOC 2 control environment should connect these risks to specific, repeatable controls and retain evidence that those controls are operating effectively throughout the reporting period.