Nailed it. Likewise, Enterprise customers don’t demand SOC-2 and similar certifications from their vendors because they actually think that will be effective in stopping data leaks, it’s just so they can say “reasonable measure were taken to select a secure vendor.”

Any large organization, private or public, is full of checkboxes and CYA. Test proctor software is just another example.