Passing an audit is not the same as being secure

Distinguishes compliance from security as separate goals, and covers SOC 2's Trust Service Criteria plus the Type I vs Type II distinction.