SOC2 is an administrative process and rubber stamp whether or not you prepare for it. You should build a security practice to avoid costly security incidents, and let your sales process tell you when it's time to get a SOC2, which itself has zero to do with security.