In a Crowded vCISO and SOC 2 Market, Founder Stories Stand Out. Here's Ours.

If you have talked to three virtual chief information security officer (vCISO) or SOC 2 providers this quarter, you have probably heard one pitch three times. Audit-ready in weeks. A fraction of the cost of a full-time hire. Senior experts. A trusted partner. Enterprise-grade, end to end, peace of mind.

None of that is false, and that’s the problem. When every provider can say it, it stops helping you choose.

We sell in this market, so we hear the pitch from the inside too, and we know how ours can sound next to everyone else’s. That’s worth taking seriously.

Here is our answer, and it’s the same advice we’d give you about any firm, including us: when the claims converge, look at the story. Who started it, and why. How they get paid, and by whom. Who they turned down. What they did when a call came in at 2 a.m. Stories are the one part of a pitch a competitor can’t copy, because they’re made of names, dates and people who can be asked.

So this post does two things. It explains why the vCISO and SOC 2 lane got so crowded, what that does to the founder on the buying side, and what a founder story carries that a pitch can’t. And it tells ours, plainly, with the parts we’re proud of and the parts we learned the hard way.

The short answer

The vCISO and SOC 2 market grew fast around a standardized deliverable, so the pitches converged on the same three promises: speed, savings and seniority. Promises that everyone makes carry very little information. A founder story carries a lot, because it’s specific, checkable and expensive to fake.

To choose a partner, ask the questions that pull a story out of a pitch, then ask for evidence. To win your own enterprise buyers, do the same thing in reverse: tell them who owns security at your company, why you invested in it early, and what you did the last time something broke, with documents attached.

And if you want to know who we are: two chosen-family brothers who met in Silicon Valley twenty years ago, started a security podcast in 2021, said yes when founder friends asked for help in 2023, and grew to a team of more than 50 people through referrals. We’re revenue-funded, we bill in 15-minute increments, and we have no commercial relationships with software vendors. The details, and the reasons, are below.

Why every pitch sounds the same

Nobody set out to make the market sound alike. It happened for ordinary reasons, and they’re worth understanding, because they tell you where to look instead.

The deliverable is standardized. A SOC 2 report follows the AICPA’s Trust Services Criteria. That’s what makes it useful: a buyer can compare one report with another. It also means every provider is selling toward the same finish line, so the marketing competes on the two things left to compete on, how fast and how cheap.

The supply grew faster than the vocabulary. In Cynomi’s 2025 survey of managed service providers (MSPs) and managed security service providers (MSSPs), the share offering a vCISO service jumped from 21 percent in 2024 to 67 percent in 2025, and half of the rest planned to launch one by the end of the year. Seventy-nine percent said small and midsize businesses showed high demand, and providers using AI reported cutting vCISO workloads by an average of 68 percent (The Hacker News, on Cynomi’s report). When two-thirds of an industry offers the same service, a year after one-fifth did, the landing pages start to rhyme.

The title is easy to claim. “You don’t have to have been a CISO or anyone in a higher-ranking position to qualify to be a vCISO,” Kristin Demoranville, the chief executive of AnzenOT, told CSO Online, in a piece on the role as a career path. She meant it as encouragement, and it’s a fair point about talent. It also explains why a buyer can’t read much into the title. Ayman Elsawah, who says he coined the term “vCISO” in 2015, wrote that it “means so many things to many people”.

Many firms work on the same platforms. Compliance automation is a big, healthy business now. Sacra estimates Vanta passed $300 million in annual recurring revenue in April 2026, after a Series D at a $4.15 billion valuation (Sacra). Several platforms run partner programs for vCISOs and MSPs, which we wrote about in question 5 of our fractional CISO guide. Same platform, same policy templates, same dashboard screenshots, same promise.

Prices are hard to compare, so pitches compare promises instead. A July 2026 benchmark of published vCISO rates found monthly retainers from $2,000 to $20,000 and hourly advisory rates from $175 to $600, and summed up the buyer’s experience in one line: “Ask what a virtual CISO costs and you get a different answer from every page” (vcso.ai).

None of this is a scandal. A crowded market is good news for buyers on price and availability. The scarce thing it creates is trust, because the signals you’d normally use to choose have been spent by everyone at once.

What sameness does to the buyer

On the other side of every pitch is a founder with a deal on the line. Usually it’s your first big enterprise customer asking for a SOC 2 report, a security questionnaire you can’t finish alone, or an investor asking who owns security. You need help, you need it to be good, and you have one shot at choosing.

Economists have a name for what happens next. In 1970, George Akerlof described a used-car market where buyers can’t tell good cars from bad ones. Buyers pay an average price for an average guess, sellers of good cars can’t get paid for quality, and the market drifts toward the lemons (Akerlof, “The Market for ‘Lemons’”). Michael Spence’s answer, three years later, was signaling: a claim helps a buyer only when it costs the seller something to make it, and costs a weaker seller more (Spence, “Job Market Signaling”). “Senior experts” costs nothing to type. Twenty years of working with the same people costs twenty years.

Buyers feel this even when they’ve never read either paper. 6sense’s 2025 survey of more than 4,000 business buyers found that 94 percent of buying groups had ranked their preferred vendors before they ever contacted a seller, and that they bought from that early favorite 77 percent of the time. “Vendors that can’t provide clear answers upfront aren’t even making the shortlist,” said Kerry Cunningham, who leads research there (6sense, via Business Wire). Meanwhile, Edelman and LinkedIn’s 2025 study of nearly 2,000 professionals, citing Matt Dixon’s research, notes that more than 40 percent of B2B deals stall because people inside the buying group can’t agree (Edelman). Sameness feeds both: it makes the early shortlist a guess, and it gives the people who have to agree nothing specific to agree on.

When the fastest promise was manufactured

In March 2026, the sameness problem got its sharpest example. An anonymous writer published a detailed account alleging that Delve, a Y Combinator-backed compliance startup that had raised a $32 million Series A at a $300 million valuation, produced fake evidence and auditor conclusions for customers, through audit firms that approved what it generated. Delve disputed the allegations and said final reports are issued solely by independent, licensed auditors (TechCrunch). The post reached 836 points and almost 300 comments on Hacker News. We covered what buyers now check in Is Your SOC 2 Real?, so we’ll keep this short.

A detailed and brutal look at the tactics of buzzy AI compliance startup Delve

"Delve built a machine designed to make clients complicit without their knowledge, to manufacture plausible deniability while producing exactly the opposite."

Erin Griffith (@eringriffith) · March 19, 2026

We don’t think the lesson is about one company. It’s about what a buyer can see. “Fastest SOC 2” is a promise every firm in the lane can make, and none of the customers who chose on that promise could see the difference until someone looked behind it. One commenter put the opportunity well:

"In a way, this may be a good thing for the 'compliance' ecosystem because it will prompt people to actually read the report and check the evidence, as opposed to trusting a badge."

sebmellen, on Hacker News, March 21, 2026

Another described the founder’s side of the table with uncomfortable honesty:

"Most people only care about compliance if it stops them from closing a deal. I was at a startup where some enterprise said we needed a SOC 2. The founder talked them out of it by giving them a discount if they'd waive the requirement."

icedchai, on Hacker News, March 20, 2026

We understand that founder. Compliance often arrives as a toll on the road to revenue, and when every provider looks alike, the cheapest and fastest toll booth wins. The way out isn’t to care less about speed. It’s to choose on something that tells you what you’re getting.

What a founder story carries that a pitch can’t

A pitch is a set of claims about outcomes. A founder story is a record of choices. Choices are what you actually want to know about, because the firm will keep making them on your account after you sign. Here’s what a good story tells you that no tagline can:

Incentives. How the firm is funded and paid decides what it optimizes for. A venture-backed firm has to grow fast. A retainer pays the same whether the month was busy or quiet. A vendor referral pays when a tool gets bought. None of these is wrong, and all of them shape advice. You can only see them in the story.

Skin in the game. A story has names and faces attached. The founders who tell it on podcasts, at conferences and on LinkedIn for years have staked something that a stock photo hasn’t.

Behavior under stress. Every firm is responsive in the sales process. The story of the worst night with a client tells you who picks up when the deal is signed and the incident is real.

Who they say no to. A firm that has turned down money to stay focused on a kind of customer is telling you who it is for. A firm that has never said no to anyone is telling you something too.

Continuity. Teams that have worked together for a long time make fewer handoff mistakes. “How long have the people on my account worked together?” is one of the most revealing questions you can ask a services firm.

This is also why referrals still move so much of this market. A referral is a story told by someone who isn’t selling. It’s how we grew, and it’s the reason the next section has more detail than most “about us” pages.

Our story

Minnesota, Apple and a lot of motorcycles

Jon grew up in Minnesota, and you can still hear it. His way of describing himself to founders on first calls is that he gets “irrationally excited about all things security.” He studied computer science, zoomed in on security as early as he could, and then, in his words, “Apple pulled me out here to the Bay Area.” What followed was a long engineering career on the defending side, building and running security, not breaking in for a living. He’s a blue-team engineer at heart, and he says so.

Sasha started his security career in Silicon Valley too, and has said he was shaped by the people around him there. His work ran through heavily regulated industries and security solutions for global financial institutions before he started building companies from the ground up. His strengths are the deep technical ones: secure architecture, privacy and cryptography.

We met in Silicon Valley about twenty years ago. We call each other chosen-family brothers, which is the most accurate description we’ve found. For years the plan was mostly motorcycles. At some point we started building companies together instead of just riding together, and YSecurity is the one that took off.

The podcast came first

Before YSecurity, there was The Security Podcast of Silicon Valley. The first episode went out on May 6, 2021, and the second was a conversation with Andrew Gontarczyk, then the CISO of Pure Storage, about building a security team. We’re at 106 episodes now.

We didn’t plan it as a business strategy, but it became our education. Interview enough security leaders and you learn what buyers actually expect, how a CISO at a bank thinks differently from one at a hospital, and which parts of a security program get read and which get filed. In February 2024 we published an episode with no guest at all, Founder’s Guide to Compliance, to explain the alphabet soup of SOC 2, ISO, NIST, HITRUST, PCI DSS and FIPS to founders in plain language. It’s the closest thing we have to a recording of how we sound when we’re explaining this to a friend.

Listen · Episode 37, Founder's Guide to Compliance, with Jon and Sasha (18 minutes)

Friends asked for a little help

YSecurity started in 2023 the way a lot of good things start: with friends. People we knew were starting companies. They were great builders and not security people, and sooner or later each of them hit the same wall. A big customer wanted a SOC 2 report. An investor asked who owned security. A security questionnaire showed up with a hundred questions.

They didn’t want to run a hiring process for a role they couldn’t scope yet, so they asked us to help a little. When friends who are building something ask for help with the thing you love, saying yes is easy. So we said yes, and we started contracting part time. As Jon puts it, it “made absolutely no sense for anyone to hire us full-time.”

That sentence turned out to be the whole business model. Early companies need senior security judgment in bursts, around a deal, an audit or an incident, and then they need it to get quiet again. By then we had become entrepreneurs ourselves, which changed how we thought about security work. We understood what money and time mean to a company that has little of either, and we started measuring security programs by what they did for growth.

Jon says it this way to founders: with a very traditional security person, “you could throw them a budget, they could burn it, it’s going to make things more secure, but I’m not sure that would directly translate into growth.” Different markets set different bars, and a SOC 2 Type 2 aimed at a bank isn’t the same project as one aimed at a hospital or a defense buyer. Knowing which bar you’re aiming for is most of the work.

Then it was too much work for two people

More founders heard about it and asked. When the work became more than two people could do well, we brought on our first teammate, someone we had worked with for years. Then another. The pattern held: almost everyone who joined in the early days was someone one of us had worked alongside in a long career in Silicon Valley security. “So we got the family back together,” Jon says.

That network still shows up everywhere. In September, Pierre Betouin and Jean-Baptiste Aviat, who worked alongside Jon at Apple, filled Accel’s San Francisco office for Tolmo Day and showed live demos of their autonomous security agents. And there’s a small, growing YSecurity team in Minnesota, where Jon grew up. Three of them represented us at Twin Cities Startup Week in September.

On The Disciplined Troublemakers podcast, Jon told host Scott Shagory how we went from two people to more than 45, through referrals alone. We’re 50 strong now, and the referral part hasn’t changed. The team includes corporate security, cloud and infrastructure security, a red team of penetration testers, governance, risk and compliance specialists, and security leaders who take point on each partnership. Jon will tell you, cheerfully, that compliance isn’t the part of security that gets him out of bed in the morning. That’s exactly why the team includes people who love it.

We tried going big, and came home

At one point we did what growing services firms are told to do and moved upmarket, toward large publicly traded companies. We landed a few of those deals. We also found that the approvals, the procurement cycles and the pace didn’t fit how we work or who we work best with. Jon talked about it on the same podcast, in a segment on high-leverage decisions. We came back to startups and to companies that move like them.

That detour taught us who we’re for, and it’s why our agreement is written the way it is. Founders building fast need a team that can move at deal speed, scale up for a SOC 2 or a big launch, and quiet down to maintenance afterward without a renegotiation. Some of our partners do grow up and get acquired. Robust Intelligence, which we took through SOC 2 Type 2 with zero deviations, was acquired by Cisco four months later for $400 million. When a partner is acquired, we sometimes keep running security inside the company that bought them. We go where our partners go. We just start with founders.

How we’re built, and why

Every structural choice we’ve made comes from those early years of helping friends, and each one answers a question a founder should ask any firm.

We’re revenue-funded. We have never taken venture capital. There’s no board of directors pushing for a growth curve. We grow when partners stay, and partners stay when the work is good. That’s the incentive we want.

Everyone bills in 15-minute increments. Every task has a description, every partner can set a monthly cap, and as Jon tells people interviewing to join us, “Everyone gets paid in the same little 15-minute increments.” When a project is done, we ramp down to maintenance, because a quiet month should cost less than a busy one.

No commercial relationships with software vendors. We’ll happily operate the tools you already chose, and we’ll tell you what we’d pick and why. As Jon puts it to founders, there’s “no extra money being put in our pocket if we recommend something.”

Love us, or let us go. That’s the first line of our agreement, and there’s no long-term contract behind it. A partner who can leave any month keeps us honest every month.

The whole team, not one advisor. A vCISO helps you decide where your security program should go. Yash Kosaraju, the CISO of Andreessen Horowitz (a16z), told us on episode 104 that a startup’s first security hire is “mostly a staff level, senior staff level engineer,” someone in the code and the infrastructure, hardening and building things. Most early companies need both of those people some of the time and neither of them full time. So our vCISO service brings the leader and the team behind them.

We show up at 2 a.m. The story Jon tells most often isn’t about our biggest account. One night a call came in from a partner, not a large engagement but an important one to us, and “15 minutes later, we had four experts on a Zoom call” working the problem with their engineers. Jon’s version of our standard: “we don’t declare success until we see our partners as success.”

What we’re still learning

A founder story that’s all wins isn’t a story, it’s a pitch, so here are a few things we learned the hard way.

A bench of brilliant people doesn’t deliver on its own. As the team grew, we learned that great operators still need someone whose whole job is the plan and the date, and that a partner should hear about a slipping deliverable from us before they notice it. The model we borrowed comes from Apple, where Jon saw program managers whose job was to give leadership an accurate, unfiltered view of the schedule.

Saying yes to every kind of customer feels like growth until it isn’t. Our detour upmarket made us better at large-company work and clearer about where we’re at our best.

And honesty about pace matters more than speed. Our case studies, Augment Code’s SOC 2 Type 2 in five months and its ISO 42001 certification in 93 days, are fast for good reasons that we can explain step by step, and we wrote up how long a SOC 2 audit really takes for anyone who wants the honest timeline before a sales call.

Test any pitch, including your own

Here’s a small tool we built for this post. Paste any pitch: a provider’s homepage, the first slide of a sales deck, an outreach email, or your own company’s “about” page. It marks the phrases any competitor could say unchanged and the details only one company could say, then suggests the questions to ask next. Our own homepage lights up a few squares too, so go ahead and try it.

Interactive · 1 minute · Runs in your browser

The same-pitch detector

Paste a pitch, then press Check. Dashed underlines are phrases a competitor could say unchanged. Solid marks are details only one company could say: names, dates, numbers, places and things that happened.

The pitch

Check the pitch Load a typical pitch Load a story-led rewrite Clear

…verdict

…sentences a competitor could say unchanged

…interchangeable phrases

…story details

The detector needs JavaScript. The phrases it looks for are on the pitch bingo card above.

Copy the questions Download the report (.md)

The text you paste stays on this page. Nothing is saved or sent unless you use the email form below, and that sends counts only.

Send me the founder-story questions →

We get your email and the counts above, never the pitch itself. Jon or Sasha replies with the question list and an offer to answer every one of them about us. No sequence.

A note on how to read the result. A pitch full of interchangeable phrases isn’t a dishonest pitch. It’s an incomplete one. The fix is never to delete the claim, it’s to attach the fact that proves it: who, when, how many, what happened.

Questions that turn a pitch into a story

These are the questions we’d ask any vCISO, fractional CISO or SOC 2 provider, including us. Each one is easy to answer with a story and hard to answer with a tagline.

1. Why did you start this firm, and what were you doing right before? You’re listening for a reason that isn’t “the market is big.”
2. How are you funded, and who pays you besides us? Investors, platform partner programs, referral fees and resale margins all shape advice. Ask for the list in writing.
3. Who will do the work, and how long have those people worked together? Ask for names and LinkedIn profiles. Then ask how the senior person on the sales call stays involved after you sign.
4. Tell me about the worst night you’ve had with a client. What happened, how fast did you respond, who was on the call, and what changed afterward?
5. Who have you turned down, and why? A firm that can answer this knows who it’s best for.
6. When would you tell us to stop paying you? A partner should be able to describe the day you’ve outgrown them, and help you hire.
7. Can I talk to a founder you’ve worked with for more than a year? Year-two references know things year-one references don’t.

For a deeper interview, Sasha wrote the companion guide, Hiring a Fractional CISO? 7 Questions That Separate a Partner From a Logo, with a scorecard for comparing candidates. If you’re still deciding whether you need outside help at all, start with What Is a vCISO? and In-House, On-Demand, or YOLO?, or take the 10-question in-house vs on-demand quiz.

Tell your story to your first enterprise buyer

Here’s the part of this post that’s for your own company, not your choice of security partner.

Your first enterprise buyer has the same problem you have. Every startup in your category says it takes security seriously, and every security page says “enterprise-grade.” The buyer’s security team can’t tell you apart from the last vendor any more than you can tell two vCISOs apart. And the person who championed you inside that company has to defend the choice to colleagues you’ll never meet.

Jon describes what’s happening on the buyer’s side this way: enterprise buyers are “protecting their reputations in their organizations, they’re going to look for the least risky. And so the one that stands out is going to be the one with the strongest security program.”

The strongest program isn’t always the biggest. Often it’s the one with a clear story behind it:

• A named owner. Who is responsible for security, and how can the buyer reach them? A real name beats a shared inbox.
• Why you invested early. One or two sentences about the decision, in your own words. “We got our SOC 2 Type 2 before our first enterprise deal because our customers trust us with their payroll data” says more than any badge.
• The last time something went wrong. What happened, how you found out, what you did, what changed. Buyers trust teams that can describe their incidents calmly.
• The evidence. The report, the penetration test letter, the policies, the security slide in your board deck, and the answers you’ve already prepared for the questionnaire.

When a security person shows up on a sales call, bring your security person too. That’s often what our partners do: they invite their YSecurity lead, who can talk through the roadmap and why it matters to the company. A buyer’s security team can hear the difference between someone reciting a policy and someone who’s been doing this work for a career.

If your SOC 2 report just landed, our playbook for the week after your SOC 2 report lands covers the six questions buyers ask next. And if you’d like help telling your security story to a specific buyer, that’s what our sales support service is for.

Where to find us

The easiest way to check a founder story is to meet the founders, or at least hear them in public. Here’s where we’ve been.

• The podcast. The Security Podcast of Silicon Valley, 106 episodes since May 2021, with CISOs, founders and investors. Recent ones include a16z’s CISO on the approve button, shrinking what a breach can reach and the prompt injection hiding in the fine print.
• Conferences. Our field notes cover the AI LAX Summit, Tolmo Day, Twin Cities Startup Week, Black Hat USA 2026, Gartner’s Security and Risk Summit, MicroConf, BSides and DEF CON 33.
• The team. Every operator on the About page is a real person you can look up, and most of them came to us through someone they’d already worked with.

That’s our story. The questions above work just as well on us as on anyone else, so ask them. If we’re the right fit, you’ll know quickly. If we’re not, we’ll say so and point you to someone who is.

Jon and Sasha