Compliance automation tools show you a readiness percentage for frameworks like SOC 2, and the number is usually high. I wanted to know what sits behind it, so I read the vendors' own documentation rather than their marketing: Vanta, Drata, Secureframe, AWS and Microsoft.
Mostly the checks read a setting, confirm a policy exists or has been acknowledged, or compare account lists. Of 165 documented Drata tests, about half read a configuration setting and about a third read a document. Only 9 to 16 look at real exposure, like open vulnerabilities or services reachable from the internet, and even those can pass once findings are excluded. It runs about once a day, not continuously. Drata lists between 78 and 179 controls per framework it doesn't monitor automatically, and tests can be disabled, findings excluded and items scoped out, all of which move the percentage. AWS and Microsoft say plainly that their tools don't assess or guarantee compliance, and none of the compliance disclaimers mentions security at all.
There's a reasonable case the other way. Continuous checking does catch controls that slip between annual audits, and that slippage is common. Some of what gets checked, like system hardening, is linked to fewer incidents in insurer data. Vanta does check for servers exposed on admin ports, and Microsoft's Cloud Secure Score weights assets by exposure. What I couldn't find was a single published study linking these scores to breaches; the only evaluations were of a US federal programme and rested on officials' opinions or on data quality, and where an inspector ran its own scans it found tens of thousands of unfixed serious vulnerabilities.
So the percentage mostly reflects conformance to a vendor's rule set, checked daily, with nothing tying it to breaches, though some of it does look at real exposure and not every vendor presents the output as security posture. You can't settle this from documentation alone. I'd keep the monitoring, report its gaps next to the score, and test real exposure separately.