We Almost Partnered With Delve. Here's What Stopped Us.

By now, most people in the compliance world know what happened with Delve. The whistleblower report. The fabricated audit evidence. The identical SOC 2 reports. The rubber-stamp auditors. Y Combinator asking the founders to leave the program. A $300 million valuation collapsing under the weight of allegations that the whole thing was, as the whistleblower put it, "fake compliance as a service."

What most people don't know is that Com-Sec was weeks away from being their lead vCISO partner for HITRUST clients.

As a small company, you fight hard for every client and every referral. When Delve approached us about a partnership, the pitch was compelling: they had a large and growing client base, many of them in healthcare, and they needed experienced vCISO support to help their HITRUST clients get through the process. We would be the go-to partner for that work.

For a firm our size, access to that kind of client pipeline was significant. I enjoyed my conversations with their founding team. They were sharp, moved fast, and seemed to have real traction. We started putting together a co-branded blog post. We were building the relationship and getting ready to kick things off.

Right before we were about to formally launch the partnership, small things started not adding up. We were getting requests to turn things around over weekends and after hours on timelines that didn't make sense. Deliverables that normally take careful review were being treated as checkbox items to knock out as fast as possible. The urgency wasn't the kind that comes from a client in a crunch. It was the kind that comes from a process that's been designed to skip steps.

Something felt fishy. I couldn't point to one specific thing, but the overall pattern didn't sit right with how we approach compliance work. We slowed down. We stopped rushing to get the partnership finalized. We pulled back on the co-branded content. We decided to wait and see.

In March, the DeepDelver whistleblower report dropped. Nearly 500 draft SOC 2 reports that were 99.8% identical. Pre-written auditor conclusions generated before clients even submitted evidence. Fabricated board meeting minutes. Audit firms that were rubber-stamping reports without independent testing. Hundreds of companies, some publicly traded, some handling PHI for millions of patients, potentially exposed to regulatory liability because they trusted a platform that was producing the appearance of compliance without the substance.

Y Combinator removed them. Customers scrambled to figure out whether their certifications were even valid. The compliance industry had its Theranos moment.

And we had dodged a bullet.

Trust your instincts. When something feels off in a business relationship, slow down. The pressure to move fast, especially when the opportunity looks good, can override the signals your experience is sending you. In compliance especially, speed that comes at the expense of rigor is a red flag, not a feature.

Vet your partners the way you'd vet a vendor. We tell our clients to scrutinize their vendors' security posture. The same standard applies to business partnerships. A compelling pitch and a large client base don't mean the underlying operation is sound.

There are no shortcuts in compliance. This is the core of it. SOC 2, ISO 27001, HITRUST: these frameworks exist to provide real assurance that real controls are in place and operating effectively. When someone promises to get it done in days instead of weeks, or treats evidence collection as an afterthought, they're not innovating. They're cutting corners. And eventually, the corners catch up.

Protect your reputation above all else. If we had gone all-in on that partnership, our name would have been attached to work product built on a fraudulent foundation. For a small firm, that's not a setback. That's potentially fatal. The short-term revenue wasn't worth the long-term risk, even though we didn't fully understand the risk at the time.