In March 2026, an anonymous group calling themselves DeepDelver published a 10,000-word investigation that should have surprised nobody in this industry, and somehow still managed to. Of 494 leaked SOC 2 reports from compliance startup Delve, 493 were essentially the same document, with the company name swapped and identical grammatical errors copy-pasted throughout. All 259 of Delve’s Type II reports claimed zero security incidents over the observation period. Across 259 separate companies. The probability of that being true sits somewhere between “lottery winner” and “miracle.”

Auditor conclusions were allegedly pre-populated before clients had even submitted their company description. The supposedly US-based audit firms traced back to Indian certification mills operating through shell entities. Trust pages went live the moment new customers first logged in. Y Combinator, which had backed Delve through a $32 million Series A at a $300 million valuation, asked them to leave the programme. Delve disputes parts of the report. The damage is already done.

Why Trust Broke

Compliance has been running on a convenient fiction for years. If the artefact exists, the control exists. A SOC 2 report lands in the vendor portal, box ticked. Nobody actually reads the thing. Procurement treats them as turnstiles, boards treat them as proof of security, auditors treat them as billable hours.

Delve industrialised the gap. They told the market what it was already willing to hear, that compliance could be done in ten hours instead of two hundred, and the market wrote them a cheque. The industry did not get duped. It got reflected back at itself.

SOC 2, that smartly-suited American auditor we have professional affection for, did not sign up for this. He came over from the AICPA to evaluate scoped controls during a defined observation period, not to rubber-stamp conclusions written before the audit started.

The Way Forward

Trust returns through verifiable work, not louder marketing.

Stop buying speed. If a vendor promises certification in days when the standard requires months of observation, they are not faster. They are skipping the part where the work happens.

Verify the auditor independently. Confirm the firm is real, accredited, and based where they claim. Ask whether they designed and executed their own tests, or merely signed conclusions someone else drafted.

Build the security programme first. Compliance is the receipt for work already done. If you skip the work, the receipt is worthless, and a worthless receipt is also a regulatory liability.

The Consultant Difference

Here is the awkward truth nobody at Delve was paid to say. A trusted advisor would have told their clients “you are not ready” before the cheque cleared. They would have flagged “compliance in ten hours” the way a structural engineer flags load-bearing walls drawn in crayon.

Platforms automate. Consultants own the outcome. When the auditor returns next year and asks how your access reviews actually run, an automation tool cannot answer. A human who built the programme with you can.

The Delve customers now facing potential HIPAA exposure and GDPR penalties of up to four per cent of global revenue did not lack technology. They lacked someone in the room willing to tell them the uncomfortable thing.

That gap, between the platform that says yes and the consultant who says not yet, is the entire reason this profession still matters.