Jonathan Oh

[Jonathan Oh @jonathanoh]

Really enjoyed this episode with @zoink and @petergyang

On craft, intention, and point of view in the AI era:
"...mindset of use AI as a starting point. Push with craft and intention and care towards the final output that you want to get to."

https://t.co/N8VGCHTYXZ

[Jonathan Oh @jonathanoh]

@fin465 GUIDE. Thanks Finn!

[Jonathan Oh @jonathanoh]

The details in this report are wild if true

We once did a security audit with a Big4 firm for our startup, and a lot of it boiled down to sending over screenshots of configs and PDFs of policies. There’s a big gap between proving you have controls and proving they actually work

[Ryan @ohryansbelt]

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown:

> 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in
> Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions
> All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client
> Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months
> The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done
> Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author
> Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper"
> When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams
> Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved
> When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance
> Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor

[Dan Go @CoachDanGo]

The average American gets 3000 to 4000 steps a day.

This pales in comparison to our hunter gatherer ancestors who got 16,000 to 17,000 steps.

This image shows 2 brain scans that represent a students neural activity during a test following sitting and walking for 20 minutes.

The color blue represents lower neural activity, while the color red shows higher brain activity in a given region.

This shows that exercise has a massive impact not only on your physical health but your mental health.

Here are 5 reasons why:

1) It increases serotonin, norepinephrine & dopamine, which manage your thoughts & emotions.

2) It releases endorphins into your body that block out pain and make you feel good.

3) It promotes neuroplasticity, which enhances your brains ability to learn skills and change.

4) It increases oxygen supply to your brain that can help with memory, flexible thinking and self control.

5) It helps you manage stress & increase energy, which will help you become better at every aspect of life.

If exercise came in pill form, it would be plastered across the front page, hailed as the blockbuster drug of the century.

Do you need to hit a gym to get the benefits? It helps but no.

You can find ways to get more movement throughout your day.

It could be taking the stairs instead of using the elevator.

Or parking a bit farther from your spot. You could even do walking meetings.

You can do micro workouts like doing 10 pushups each time you use a door or squats before you sit.

There are many ways to get more exercise throughout your day that the only thing you have to get over is yourself.

Do not sleep on what a few more steps or a bout of intense exercise will do to your brain and body.

It is the #1 metahabit in the world for a reason. Use it to your advantage.

Ps. Credit to @SahilBloom for being the first one to bring this brain scan to my attention.

[Usama Syed, MD @usamasyedMD]

If you heard the latest @theallinpod and the sunscreen safety topic @friedberg raised surprised you, let me add some details as a dermatologist.

I'll explain the 2 types of sunscreen, their safety profiles, and also answer @chamath's Q ("do brown guys need sunscreen?") 👇🏼1/

[KUMO | withkumo.com @withkumo_]

Top reads this week if you're buying a small business:

👀@SMB_Attorney on upcoming SBA changes

✍️@divitkos and the 2023 SaaS CEO survey

⚙️@RegZeller made a list of everyone in SMB manufacturing for you

🤑@Dan_Tamkin on how much a broken deal costs

https://t.co/5JEU0zJwmF

[KUMO | withkumo.com @withkumo_]

Must-reads this week if you're buying SMBs:

💀4 SMB skeletons in @AZ_SMB's 1st acquisition

🏆@adell50 on how to stand out in a crowded marketplace (in response to @SMB_Attorney)

⌛Things @ChandlerReedSMB wishes he knew from day one

https://t.co/O6uAl5SwiR

[KUMO | withkumo.com @withkumo_]

Top reads this week if you're buying businesses:

🔢@guessworkinvest's downloadable spreadsheet to evaluate deals

🌴Why @thomasince is eyeing Florida for acquisitions

⚖️@KHendersonCo on the downsides of S Corps for M&A

🎉A giant congrats to @girdley

https://t.co/9n1ON04erm

[Joe Pompliano @JoePompliano]

The Savannah Bananas are the best story in sports.

Their owner went $1.8 million in debt to build the Harlem Globetrotters of baseball — and it's working.

The team now makes $200,000 per home game and is about to embark on a 70-game tour across 22 states.

Here's the story 👇

[Jonathan Oh @jonathanoh]

Good advice

[Sahil Bloom @SahilBloom]

When you find out you’re going to have a baby, you get a lot of advice.

Unfortunately, most of it sucks.

Here is the straight talk parenting advice I wish I had received:

[Jonathan Oh @jonathanoh]

@_MBAtoETA We use https://t.co/BH43QmWNK7 to set up Wyoming LLCs - takes less than $100 to get setup, and they also have affordable managed services to handle your annual reporting and renewals.

[Jonathan Oh @jonathanoh]

@craig_soderdahl FBA

[Craig Soderdahl @craig_soderdahl]

I built my $10M business on amazon with a profit margin of over $2.7M and sold it in 2021.

I've put together a doc that will help you to get an intro on Amazon FBA and an overview of how it's done.

Like+retweet+Comment "FBA" and I'll send it over.
(Must be following)

[Jonathan Oh @jonathanoh]

@KHendersonCo Or pays to have a Costco membership! 😆

[acquire.com @acquiredotcom]

Looking for data on startup valuations?

Check out @microacquire's 2021 analysis of acquisition multiples in the first of our biannual multiple reports.

https://t.co/SPuwRNGS7l

[Jonathan Oh @jonathanoh]

And we're live! 🚀

[KUMO | withkumo.com @withkumo_]

🚨BIG NEWS: our beta is live!🚨

We know how painful it can be to search for an acquisition: we've been there.

So we built the most powerful deal aggregator for listed deals out there (60,000+ deals!)

Try Kumo now, free for 14 days 👉 https://t.co/o0uxQ0hGxc

[Jonathan Oh @jonathanoh]

Never trust a #HoldCo based in the Ozarks 😂

[Jonathan Oh @jonathanoh]

Just finished Ozark. Man. 💯

[Jonathan Oh @jonathanoh]

@hunterjones Gusto is great, especially if you have salaried employees. I'm using it now for a business with 100% part-time hourly employees & subcontractors, and don't love it as much (not as automated). Still feels much better than others I've seen