A SOC 2 report is an independent auditor's report on how an organisation's controls worked over a period. I wanted to know what one actually tells a reader about security, and whether that depends on scope choices the reader probably never looks at.
A type 2 report does give you something real: the auditor's opinion on whether controls worked throughout a period, a description of the tests and their results, and an independence requirement on the auditor. Opinions can be qualified or adverse, so it isn't a rubber stamp. What it doesn't cover is the part people skip. The audited organisation chooses which criteria categories are in scope and describes its own system boundary, and it can leave suppliers out entirely. The opinion covers that described system over a past period, not the organisation as a whole and not its future security.
Nine organisations said publicly that they held or had undergone SOC 2 audits before a security incident. For none of them could I find a source showing the report period, the opinion, or whether the affected systems were in scope, which is exactly what you'd need to say anything at all; in one case the compromised product wasn't on the audited list. I'm not counting a tenth, Snowflake, because its investigator found no evidence Snowflake itself was breached. I also found no study comparing incident rates for organisations with and without SOC 2, and none measuring whether readers read the scope sections.
So I can't tell you whether SOC 2 reports predict anything, and neither can anyone else from what's published. Nothing here shows they're worthless. Nothing here shows that holding one is, on its own, assurance about an organisation's security as a whole. The scope section is the part that decides which of those you're looking at, and it's the part nobody reads.