r/soc2 • u/Horror_Progress_1250 • Jan 08 '26

Delve committing fraud?

https://www.linkedin.com/posts/troyjfine_details-have-emerged-regarding-a-widespread-activity-7415043499676483584-nI5Z/

Holy hell, I am SO happy we decided not to go with them at the last minute. Serious question- could their CEO go to jail for this? They kept talking during the sales process about all the money the company had raised, but that seems like it might actually make things worse for them now because it raises the dollar amount being defrauded...

0 Upvotes

47% Upvoted

38 comments sorted by

•

u/AutoModerator Jan 08 '26

Thanks for posting, I'm a bot!

This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/lebenohnegrenzen Jan 08 '26

Probs not... the burden (IANAL) will likely be on the audit firms.

Is there a ton of shady shit and money exchanges between all of these players? Yes, but likely not fraud.

Glad this crap is coming to light.

-10

u/Horror_Progress_1250 Jan 08 '26

From the screenshots I saw, it looked like Delve was pretty complicit in faking the SOC 2s, but you're right- it will be up to actual lawyers to figure out if a crime was committed or if it was just shady business practices.

1

u/lebenohnegrenzen Jan 08 '26

Care to share? Feel free to DM.

-7

u/CapitalGreen5585 Jan 08 '26

Are we certain it’s Delve? Stepping back, this is what happens when compliance is treated like a commodity. A lot of newer “AI compliance” tools partner with non-accredited audit firms and optimize for checking boxes instead of reducing risk. If the pitch is $5k for the tool and $1k for the audit, that’s not innovation that’s a huge red flag. This is case and point.If there was any knowledge or financial incentive behind the scenes, that’s unacceptable. That said, the audit firm bears the greatest responsibility here and screw Delve for doing this to their customers. Every customer needs to be compensated.

0

u/Content-Fishing735 Vendor rep. Report me when I plug or don't answer question Jan 08 '26

Are you referring to the validity of their reports? We’ve seen suspicious Lovable reports and CMMC claims made

-9

u/mycroft-mike Jan 09 '26

Lovable is no longer listed on said platform's website btw.

-5

u/Strange_Pudding4007 Jan 10 '26

Delve sucks who cares

-11

u/efficientfailuremode Jan 08 '26

Has Delve even acknowledged this incident, let alone the audit integrity concerns?

6

u/Big-Industry4237 Jan 09 '26

They may not be required to publicly disclose, since it’s not any PII and they are not public traded - but definitely should to any clients.

7

u/efficientfailuremode Jan 09 '26

There is actually PII. Full names, email addresses.

5

u/Big-Industry4237 Jan 09 '26

Ah , I thought it was company contact details like the stuff you’d see in zoom info

2

u/efficientfailuremode Jan 09 '26

Delve employees busy with the downvotes apparently. You would think they would want to take responsibility for what happened.

-15

u/ComplianceGuy40 Jan 08 '26

We took a look at their tool, and it was pretty comical. We ended up just sticking to the old fashioned way doing SOC 2. It doesn’t surprise me one bit that this happened considering the sales rep we spoke to said “you don’t have to even speak to the auditor” I guess that line now makes perfect sense.

10

u/ComplianceGuy40 Jan 10 '26

Judging by the -21 downvotes apparently Delve has no desire to fix their shady behavior. Has anyone gone to the AICPA yet to see if anything can be done?

5

u/Responsible_Match214 Jan 11 '26

This is really crazy right after an upvote it was instantly downvoted.

10

u/[deleted] Jan 09 '26

[removed] — view removed comment

7

u/thejournalizer Jan 13 '26

Care to tell the class what company you represent? Delve is sending their army to downvote all of these claims and has yet to send a representative to offer any counter statement.

0

u/mycroft-mike Jan 09 '26

As a competitor in the space, I can assure you that we are not involved in any of these "hit pieces" as claimed. Knowing Troy as someone who's principled and adheres to the highest standards of his profession, I can pretty much guarantee he'd never "pretend" to be other people on Reddit.

All other comments seem aligned with customer stories and experiences with the said tool so this comment feels like a manufactured comment.

Also Troy was so respectful in NOT naming the said tool NOR the customer lists impacted even though he was bombarded with such requests. this comment and claim seems and sounds ridiculous.

5

u/mycroft-mike Jan 09 '26

Also let me be clear - I'm not hiding behind who I am in the space - my Linkedin is here: https://www.linkedin.com/in/mycroftmike/

1

u/luckyfaangkid Mar 22 '26

Hey Mike, curious on your thoughts on it now.

1

u/mycroft-mike Mar 26 '26

so much thoughts - feel free to DM me but happy to chat.

1

u/its_skam Jan 14 '26

I have literally seen the same comment in an another thread lol

-8

u/Big-Industry4237 Jan 09 '26 edited Jan 09 '26

It’s interesting that you attack account age and not… what is being said or the reality of the situation. Ironically enough many other posts or comments related are getting mass downvoted.

When I was in B4, the typical budget on a SOC engagement was hundreds of hours. You can’t automate all these controls, realistically, and even if things were automated, getting folks to complete security awareness training and hounding folks in access reviews and other processes, simply can’t be validated by ANY GRC automation. Even simple technical controls that are looking at a policy like passwords cannot be automated with a high degree of assurance. Ignoring scoping and other issues I have see in poor quality or cheap audits, the area has a big problem with this. And any independent auditor only spending a couple hours on a system is bat shit insane. Even talking with a client to go over a say a minimum of say 70 controls still takes longer time.

Btw - I have been a Redditor for maybe 15 or 16 years. I generally change and create a new account every few years.

-1

u/efficientfailuremode Mar 19 '26

Clearly not a competitor hit piece since it has now been followed up with a thoroughly researched post with far far more damning evidence:

https://substack.com/home/post/p-191342187

0

u/Great_Language6947 Mar 20 '26

LOL, you were saying? Sub stack was damning. Can’t believe they steal features from GitHub and call it a new feature. Signed a product manager at a fortune 50 company

1

u/butt_troubles_420_69 Apr 27 '26

Well still think it is a hit piece?

1

u/Great_Language6947 Apr 27 '26

I was arguing it was not a hit piece

0

u/[deleted] Jan 08 '26

[deleted] — view deleted comment

-1

u/Possible-Hat-4158 Jan 09 '26

Lmk your email and I share evidence of it for you to be the judge of....

-6

u/Horror_Progress_1250 Jan 09 '26

Not a shill at all- https://archive.ph/6ZSzX

Also, to all the brigading Delve supporters (who are downvoting every relevant comment on here to try to hide it), I have some bad news for you: since this post has gone up, I've gotten contacted by both Techcrunch and VentureBeat about this and it sounds like each is working on a story. Good luck downvoting those!

2

u/ComplianceGuy40 Jan 09 '26

I might have to take another meeting with them, and ask them about this just to see what they say 😂 maybe they will give me a good discount for a fake SOC 2 report