SOC 2 gap analysis: what the audit scope misses and attackers find anyway | Vulnox Blog