Let's be honest, Enterprise sales companies have to get a soc2 or equivalent. Otherwise, if your customers aren't asking for it, it's easy to go without. Especially at under 1000 people. I've worked at companies with ~200 employees that didn't have a security policy and were incredibly insecure. 500 is typically when b2c will start thinking about security programs, but the reality is that unless security is revenue generating it becomes incredibly hard to build out security policies
