# Jacob Riff

Jacob Riff writes about helping small companies prepare for SOC 2 and says Riff builds Klaay, a platform for managing compliance work.

- Profile: https://b2binfluencer.marketing/creators/jacob-riff/
- LinkedIn: https://www.linkedin.com/in/jacobriff
- LinkedIn followers: 3,242
- Topics: go-to-market
- Based on 16 dated posts, latest 2026-10-08

## Summary

Jacob Riff is most useful for explaining SOC 2 preparation to founders at small software companies.

- Best for: Co-authored expert content for SOC 2 audit, compliance advisory, or security-testing brands reaching 2-to-50-person software founders.
- Not for: A competing GRC or compliance-automation platform seeking paid sponsorship or product co-marketing.
- Check first: Confirm media-partnership route, terms, and audience engagement data before paid placement.

### Takeaways

- Compliance is a sales problem, not a security one.
- The SOC 2 calendar cannot be bought down.
- A spreadsheet and shared drive can work; a platform is optional.

## Main ideas

- **Compliance is a sales problem, not a security one**: Riff argues that the function asking for a SOC 2 report has changed. It is no longer just the security review: procurement asks before signing, and without a report, there is no signature, however good the product is. That moves compliance out of the IT budget and into the go-to-market stack, next to the CRM and billing system: revenue infrastructure rather than a security line item. The report gates revenue and, for a small company, can be the single thing standing between it and a first enterprise customer.
- **The SOC 2 calendar cannot be bought down**: A Type II report covers an observation window of three to six months, and almost everything that will be audited must already be in place before that window opens, not built during it. Riff's point is that urgency does not shorten the work: whatever a company spends, the timeline holds. They distinguish the engagement letter, which can be obtained quickly and often keeps a deal conversation alive, from the attestation itself, and warn that nobody should present the letter as the attestation.
- **Riff argues the case against buying a compliance platform**: Rather than deflecting the objection to the product they sell, Riff states its strongest version: a founder does not need a platform, this one or anyone's; hundreds of companies get a SOC 2 attestation every week with an AI and a Google Drive; the report is point-in-time and does not promise nothing breaks next week; and Klaay is an additional line item. What the objection misses, they argue, is the shape of the work: readiness and maintenance arrive as a hundred small tasks rather than one block. They land on the same person building the product, closing deals and answering support, taking time away from shipping.
- **The durable problem is memory, not the audit**: The argument for a system is less about passing an audit than about what happens to knowledge. Where evidence is kept, why a control was scoped a certain way and what an auditor accepted last time: if all of that lives in one person's head, it leaves when they do, and the next audit starts from nothing. Riff frames the platform's job as holding everything that has to be in place before an independent firm issues the attestation, and remembering it afterwards. They are explicit that the platform does not provide the attestation.
- **Publishing prices and skipping the sales call**: Riff treats plain public information as a distribution decision, not just a marketing one. Founders look up what SOC 2 costs and how long it takes at eleven at night on the day a customer asks for a report. Riff credits Klaay's traffic growth to laying that information out plainly, with pricing on the website and sign-up without a sales call. The pricing claim attached to the argument is an entry point of $149 per month, framed as making an early start a strategy decision rather than a budgeting decision.
- **The audit market is splitting, and the startup segment is the larger one**: Riff argues that the SOC 2 audit market is splitting between a legacy CPA model built for a 50-to-100 person company with a security officer on staff—quotes from $25,000 to $50,000, multiple scoping calls and a dedicated partner on the engagement—and a small-startup buyer who wants a quote in two emails, a scope matching its actual surface area and an auditor who treats it like a small business rather than a small enterprise. A handful of firms have adapted, Riff says, by publishing pricing, scoping Type 1 and Type 2 on a predictable cadence, and accepting platform-collected evidence without re-interviewing the founder for hours. Those firms are quietly taking a segment most of their competition has not noticed.

## Work to read

- [What the SOC 2 process actually looks like for a small team](https://www.linkedin.com/posts/jacobriff_almost-all-of-my-meetings-with-founders-needing-activity-7496230902809907200-M-8T)
- [Why a deal asking for SOC 2 today cannot be closed this quarter](https://www.linkedin.com/posts/jacobriff_most-founders-start-soc-2-the-same-way-a-activity-7507842496907956224-AR5Z)
- [SOC 2 moved from security to sales](https://www.linkedin.com/posts/jacobriff_soc-2-stopped-being-a-security-decision-activity-7487552452884373504-KRhG)
- [The audit market is splitting between enterprise and startup buyers](https://www.linkedin.com/posts/jacobriff_the-audit-market-is-splitting-too-for-soc-activity-7465821675314503680-J8h8)
- [The case that compliance platforms are a waste of money—and Riff's counterargument](https://www.linkedin.com/posts/jacobriff_someone-told-me-this-week-that-what-we-do-activity-7491180324131905537-2H9M)
- [Klaay's inclusion in the AI Report Denmark 2026](https://www.linkedin.com/posts/jacobriff_klaay-made-it-into-the-ai-report-denmark-activity-7508631024394715136-ZaG8)

## Brand relationships

- **Klaay** (owned_business)
- **Vanta** (mention)
- **Drata** (mention)
- **Thoropass** (mention)
- **RankmyAI** (mention)

## Partnerships

Jacob Riff's posts describe no sponsorship program, rate card, or partnership inquiry route. Their commercial offer is Klaay, the compliance platform they say they built, with published pricing starting at $149 a month, self-serve sign-up, and no sales call. A SOC 2 walkthrough offers readers a meeting for more detail, but that is product help, not a media-partnership channel. For a GRC or compliance software buyer, there is no published format to plan around, and they sell an overlapping product, so co-marketing would amplify a competing platform. Their stated advantages—website pricing and plain writing about what SOC 2 costs and how long it takes—could give a partner material to link to or quote, but do not establish a partnership offer. Ask them directly for a partnership route and terms before assessing fit.

## Alternatives

- Greg Spehar: For a campaign about AI governance, agent assurance, or proving how AI systems behaved, Greg Spehar is the better choice. The posts argue that AI trust should be a record, not a feeling, and describe independent runtime behavioral attestation on a standing cadence, so a record is already available when someone asks. That serves a different buyer task from helping a small software company prepare for a SOC 2 audit.
- Troy Fine: For a campaign aimed at CPA firms, audit partners, or compliance advisors debating independence and examination methodology, Troy Fine is the better choice. The posts examine whether referral fees from a single GRC tool can create an independence threat under the AICPA Code, and ask whether a firm can use Type 1 conclusions to reduce Type 2 control testing. That speaks directly to audit practitioners making professional and methodological decisions.
- Adam Holmgren: For a campaign that needs a founder peer story about going through SOC 2 at a small bootstrapped company, Adam Holmgren is the better choice. The posts describe Fibbler's path to SOC 2 Type 1 with two employees: writing policy documents, finding an auditor, reacting to the Delve compliance scandal, choosing Sensiba, and starting the journey to Type 2. They also connect compliance to customers, growth, and vendor trust. That firsthand perspective can be more persuasive to founders than an explainer.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/