DIYing SOC 2 and ISO 27001 with AI - what to automate vs buy

DIYing SOC 2 and ISO 27001 with AI - what to automate vs buy targets a $4.5B = 600,000 companies x $7,500 ACV. Rationale: ~600k SMB and mid-market orgs globally that either pursue SOC 2, ISO 27001, or vendor attestation annually; average combined spend for tooling, templates, and some consulting is roughly $7.5k/year. total addressable market with medium saturation and a year-over-year growth rate of 12% to 18% annual growth in security compliance tooling and services driven by SaaS vendor requirements and regulatory attention.

Key trends driving demand: LLM policy generation -- reduces time to draft framework-specific policies from weeks to hours, lowering the barrier for in-house compliance; API telemetry and cloud integrations -- ubiquitous logging and cloud provider APIs enable automated evidence collection and continuous monitoring; Vendor security demands -- increasing frequency of customer audits and RFP security questionnaires makes readiness a recurring operational cost.