enterprise prospect asked for a pentest report before we even finished SOC 2. that changed how we looked at vendors