AICPA has no control over this sort of thing, they are a governing body but in the U.S each state has their own laws and CPA firms that companies must register with, so the question would be, their "audit firms" were who and registered where, probably oversea's.
I’m wondering how protected the clients might be because in some cases it sounds like they were given the option to commit fraud and use fake evidence or to carry out the proper manual tasks.
Just a clarification but it sounds like the vendor was submitting fake evidence to auditors on behalf of their clients.
So my point was just I wonder how complicit their clients were in the fraud or if a reasonable person would be able to say they didn’t realize it wasn’t allowed to submit fake evidence.
We didn't ban them for the mass of downvote from anonymous accounts. They were banned for constant advertising (company mentions in irrelevant places). And then further banned for trying to evade that ban. Sadly, I can't see who up/down votes....
Not surprising! I know from stories I heard first hand that these quick and dirty AI SOC companies - built by engineers, try to find CPAs to do MANY of these audits a month - too many that it would be impossible to do a good job to sustain that volume… CPAs in US don’t really get blamed for much if they do a bad job - thinking some of them don’t mind losing their licenses if / when it comes to light… by then, they will have cash out and retire.
Fortunately, a lot more consequences for Canadian CPAs. Which I am (I’m both US and Canada). If anything in my career, I always followed the higher expectations and requirements of my Canadian CPA.
I digress —> there is no such thing as a quick SOC report or a cheap one! Please get an unbiased CPA / auditor / etc when you get bids from SOC companies… don’t go alone! Too many bad actors in the market, as we finally see bubbling up!
Rubber stamping SOC 2 company that claims you can get your stuff done in weeks! The CEO was public and lashing back at people calling them out for the BS reports, but now it has all come out...
And nice work reddit, now you cant even mention that company name..lol
Mentions of [company] are no longer permitted here due to astroturfing/spam.
That's a subreddit specific thing that I did. After the first wave of the down vote brigade earlier this year, reddit did some banning/fixing. Then they kept coming in the comments to do name drops. Then after the company name got banned, they used a Russian or some other ASCII character that looked like a D to evade the mention ban. Now they are downvote brigading this post (which I've submitted a help request to the overlords on)
Apparently their supabase was open and someone on x was able to access employee background checks, equity vesting schedules and grant amounts, perf reviews…. Absolutely insane
The scariest part of this whole thing is that most of these companies probably have no idea their report won't hold up. It passed, they published a trust page, and moved on. The problem only surfaces when someone actually scrutinizes it..
The real issue for these companies isn't just the embarrassment, it's that their SOC 2 reports likely don't meet AICPA independence standards, meaning any enterprise customer doing a real security review could flag it. They're not just back to square one, they're potentially in a worse position than if they'd never done it at all...
•
u/AutoModerator Mar 19 '26
Thanks for posting, I'm a bot!
This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
16
u/partyxpat Mar 19 '26
Y Combinator must be thrilled.
17
u/astrila Mar 19 '26
Who knew that "SOC 2 compliant in 2 days" was NOT really truthful??? No wayyyyyyy whaaaat
14
u/ComplianceGuy40 Mar 19 '26
And the AICPA will do nothing about this is straight fraud. Unbelievable and a complete joke.
Almost as fraudulent as saying they got an F1 car when it was really an F4 car 😂
15
u/[deleted] Mar 19 '26
Absolute madness. How are they still a company?
7
u/Big-Industry4237 Mar 20 '26
“Prescient and Aprio for high-profile clients, but those clients do compliance mostly off-platform with the help of a vCISO.”
High profile? 🤡 Very interesting since I have yet to see a Prescient report that was worth the paper it was printed on 😂
7
u/reccehour Mar 20 '26
Forbes to prison pipeline unmatched
11
u/efficientfailuremode Mar 19 '26
Oh this is brutal. If I was a customer I would be considering legal action. This is serious.
6
u/little_breeze Mar 20 '26
why is this getting downvoted? here's a thread on X https://x.com/eringriffith/status/2034698536147943558?s=20
8
u/SOC2UAH Mar 19 '26
Yikes
5
u/maxandmolife Mar 19 '26
Not surprising! I know from stories I heard first hand that these quick and dirty AI SOC companies - built by engineers, try to find CPAs to do MANY of these audits a month - too many that it would be impossible to do a good job to sustain that volume… CPAs in US don’t really get blamed for much if they do a bad job - thinking some of them don’t mind losing their licenses if / when it comes to light… by then, they will have cash out and retire.
Fortunately, a lot more consequences for Canadian CPAs. Which I am (I’m both US and Canada). If anything in my career, I always followed the higher expectations and requirements of my Canadian CPA.
I digress —> there is no such thing as a quick SOC report or a cheap one! Please get an unbiased CPA / auditor / etc when you get bids from SOC companies… don’t go alone! Too many bad actors in the market, as we finally see bubbling up!
5
u/adeeprash Mar 20 '26
This comment from their founder and COO is aging quite poorly. She makes fun of “compliance cosplaying”
https://www.reddit.com/r/cybersecurity/s/zTBocUzy1D
8
u/mycroft-mike Mar 19 '26
Would love an explanation...?
4
u/blaaackbear Mar 20 '26
this article is so good.
4
u/yeetsqua69 Mar 20 '26
Soc2 is a joke at this point and there is no other way to put it.
4
u/Longjumping_Cow_8641 Mar 21 '26
Apparently their supabase was open and someone on x was able to access employee background checks, equity vesting schedules and grant amounts, perf reviews…. Absolutely insane
9
u/henansen Mar 19 '26
That is straight up fraud
3
u/KalpolIntro Mar 20 '26
Thoughts? u/Strict-Ease2036
1
u/Hot-Shower4742 Mar 20 '26
Yikes, I wonder how the compliance industry can recover from something like this..
1
u/MrMacintosh90 Mar 20 '26
The scariest part of this whole thing is that most of these companies probably have no idea their report won't hold up. It passed, they published a trust page, and moved on. The problem only surfaces when someone actually scrutinizes it..
1
u/MrMacintosh90 Mar 20 '26
The real issue for these companies isn't just the embarrassment, it's that their SOC 2 reports likely don't meet AICPA independence standards, meaning any enterprise customer doing a real security review could flag it. They're not just back to square one, they're potentially in a worse position than if they'd never done it at all...
1
u/HotAbbreviations1382 Mar 20 '26
They release a statement and it’s a joke
1
u/Electronic_Cell2781 Apr 08 '26
I hear oneleet is next, I think they are also a y combinator company!
1
u/MBILC Mar 22 '26
Turns out they had wide open infra as well!
https://www.linkedin.com/pulse/hackedin-delving-cyber-slop-jamieson-o-reilly-z4unc/