What is vibe compliance?

Where the term came from

"Vibe compliance" is a riff on "vibe coding" — shipping software you described to an AI without reading what it wrote. The compliance version showed up in the discourse around March 2026, when an anonymous group published a leaked spreadsheet from the compliance startup Delve. Researchers indexed 533 reports across 455 companies and found them 99.8% identical: the same boilerplate, the same grammatical errors, the same fabricated test values, with only the company name and logo swapped. One auditor license number appeared in 487 of 494 reports. Every report logged "No exceptions noted" 220-plus times. The conclusions existed in draft before any client submitted evidence.

Delve denies the allegations and they remain unproven in court. But the leak put a name to something I'd watched build for years: a report that looks like a SOC 2 and was never an audit.

What it looks like in practice

Vibe compliance has a recognizable shape. A platform generates a stack of policies — information security, access control, incident response — from a template. The founder clicks "adopt." A dashboard turns green. None of it was tested against how the company actually runs.

The tell is that the artifact describes a company that doesn't exist. In five years of fieldwork I read a lot of policies that said access reviews happen quarterly while the access logs showed they'd never happened at all. That gap is the whole game. The policy is the *vibe*. The evidence is the *audit*. Vibe compliance ships the first and skips the second.

A few patterns I'd flag:

• Template policies nobody implemented. A 40-page security policy adopted in one click, referencing controls the team has never run.
• A dashboard green by generation, not by testing. The tool created the control, marked it present, and called it compliant. Nobody collected the evidence that it operated.
• A report with zero exceptions. A clean year across dozens of controls, no deviation ever noted. Statistically, that's not rigor — it's the absence of testing.

Why it passes a first glance and fails real scrutiny

Vibe compliance survives the procurement skim. A buyer's analyst opens the PDF, sees an auditor's logo, confirms the trust criteria are listed, and files it. The format is right. That's all the first glance checks.

It fails the second look fast. SOC 2 reports aren't meant to be generic. Section 3, the system description, is supposed to describe *this* company — its architecture, its infrastructure, its team, its real processes. Two companies in different industries with different stacks should never have the same Section 3. When they do, either the company pasted a template the auditor didn't catch, or the auditor pasted across engagements. Either way, the audit didn't happen the way it's supposed to.

You can check the auditor too. A SOC 2 must be signed by a licensed CPA firm, and reputable firms are enrolled in the AICPA Peer Review Program — searchable in the AICPA's public file. A firm that isn't enrolled, or carries a "fail" rating, is a real flag. So is a US-branded report signed by an offshore certification mill operating out of a shell address, which is part of what the Delve leak exposed.

A generated artifact is not an opinion

Here's the distinction the scandal made impossible to ignore. A SOC 2 report is a CPA's *opinion*, governed by AICPA attestation standards (AT-C 205). The standard is explicit that inquiry alone is never enough — every control needs inquiry plus corroboration: inspection, observation, or re-performance. The auditor has to independently form a conclusion about whether controls operated, and is barred from designing or running those controls themselves. That independence wall is regulatory law, not a product choice, and it's exactly why a compliance platform can't sign its own audit.

A generated artifact skips all of that. It asserts; it doesn't conclude. It has no independent party who tested anything and put their license behind the answer.

> The market reality: quality SOC 2 isn't free, and the cheap end is where vibe compliance hides.

Industry pricing tells the story. A Type II audit from a specialist firm typically runs $15K–$70K, with small-company audit fees often $12K–$20K; Big Four quotes reach $430K. When a vendor's only selling points are speed and price, something usually gives — and what gives is the testing.

That's the line I'd give any founder evaluating a report, theirs or a vendor's: a clean PDF is not assurance. The assurance is in what was tested, what was found, and who signed their name to it. If you want a real number for your own audit, use the pricing calculator on chiarohq.com or book a call.