We are 40 people, chasing our first SOC 2 because two enterprise deals require it. The automation platforms cost roughly what a part-time consultant would, and I cannot tell whether we are buying a tool or renting a process.
For small teams who have done this: what did the platform genuinely save, and what did you still have to do yourself?
It saves evidence collection, which is the tedious majority of the work, and it saves you from a spreadsheet that goes stale in six weeks. It does not write your policies in a way you can defend, it does not decide your risk appetite, and it will not fix a control that is broken.
At 40 people I would buy it, with a fixed budget of consultant hours for the parts that need judgement.
Agreed with one warning: the dashboard turning green is not the goal and it is very easy to let it become one. We caught ourselves configuring around a control to make a check pass rather than fixing the underlying thing. Put a human review over it.
That warning is the useful part. Green dashboard as a target rather than a symptom is exactly the failure mode I would fall into. Thanks.