{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Distilled Security Podcast","title":"Episode 23: Nobody read the report","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/2188c59d\"></iframe>","width":"100%","height":180,"duration":7810,"description":"In this episode of the Distilled Security Podcast, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001.\nWe also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry.\n Topics Covered\nThe Delve scandal—leaked reports, copy-pasted audits & pervasive deficiencies\nThe AICPA peer review process & AC Corp's adverse findings\nSOC 2 vs ISO 27001—oversight models, witness audits & accreditation\nThe incentive structure driving compliance to the bottom\nCompliance automation — what works, what doesn't & AI's real role\nWhat to ask your auditor before signing anything\nTrust centers — done right vs. compliance theater\nIs SOC 2 dead? What needs to change & who has to change it\n\nHosts\nJustin Leapline – @justinleapline\nJoe Wynn – @wynnjoe\nRick Yocum – @rickyocum\nHosts\nMatthew J. Schiavone - (Sikich) \n\nConnect with Us\nWebsite: distilledsecuritypodcast.com\nX:  @DisSecPod\nEmail: hello@distilledsecuritypodcast.com","thumbnail_url":"https://img.transistorcdn.com/MJdG3-EB1xgpmosNU-oEduyFhaC1R3HoELIm4f9vQDM/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9iMjk1/MTk1NTkwZTA3OThl/NzAxOGMwZjM4NTEy/MjVmOS5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}