Kelsey Waters works on Openlane, a platform that helps growing companies build security and compliance programs around their needs. Their posts discuss helping founders decide when to start compliance work and building customer and partner relationships.
Kelsey Waters is most useful for founder-facing content on when to start compliance work.
Best for
A content or advisory collaboration for early-stage and growth-stage software founders considering compliance.
Not for
Campaigns needing proven reach or paid formats, and hard-sell pushes to not-ready founders.
Key takeaways
Start compliance when a business signal makes it worth doing, not before.
Build the compliance program around the company you actually have, not a template.
Openlane moved from beta to live audits and shared onboarding and audit stories.
Check first: Confirm recent post performance, audience data, and partnership terms, as no paid format is published.
Main ideas
Start compliance when a business signal makes it worth doing, not before · Build the compliance program around the company you actually have · Advice before the sale is part of how compliance gets bought
Kelsey Waters writes about building Openlane, a platform for growing companies’ security and compliance work.
The three posts focus on helping companies decide when compliance is timely, describing Openlane’s progress from beta to customers using the platform, and explaining why compliance programs should fit the company rather than follow a template.
They offer readers insight into the business case for compliance and the practical steps involved.
Waters ties compliance advice to concrete business signals rather than suggesting every early-stage company should begin immediately.
One post points to enterprise sales, a major proof of concept or a deal with a compliance requirement as reasons to start, while recognizing that readiness may come a month or a year after a founder first hears about SOC 2.
Another traces Openlane’s move from beta to customer audits and meetings; a third argues for programs built around a company’s operations rather than a borrowed template.
Together, the posts offer a grounded view of compliance timing and implementation, and show how Waters’s priorities shape both their advice and accounts of building the platform.
Kelsey Waters' posts frame compliance as a timing and fit decision, not a default purchase.
Read more
Founders should start when a specific business signal makes it worthwhile, and programs should fit the company a founder actually has rather than a borrowed template. They pair that advice with a relationship-led approach to growth: guidance before the sale, partner relationships built on a shared point of view and visible participation in the San Antonio founder community.
Start compliance when a business signal makes it worth doing, not before
Waters argues that early-stage founders should not take on compliance just because the requirement is somewhere on the horizon.
Read more
They describe founders trying to build smartly, affordably and securely, and say it often does not make sense to start until a clear signal appears.
They name three: readiness to move into enterprise sales, preparing for a large enterprise proof of concept, or signing a significant deal that carries a compliance requirement.
A founder may hear "SOC 2" a month or a year before they are ready for a platform.
The useful work, Waters says, is helping founders understand what to do in the meantime so they are in a good position when the requirement becomes real.
In a post about building in compliance and trust, Waters says they did not expect to spend so much time helping founders decide whether to take on compliance. They treat that advice as the point, not a detour from selling.
A year later, the same instinct took a different form: Waters pushed to get Openlane fully live before San Antonio Startup Week so people they met that week could create an account instead of joining a waitlist, even while the product was still in beta.
Build the compliance program around the company you actually have
Waters says growing companies do not want a compliance program built from someone else's template.
Read more
They connect that observation to how Openlane is built, presenting flexibility to create a security and compliance program that reflects how a company operates as the shared value. The post presents Anchorpoint's founder-led model as the services-side proof and names Joe Munsayac and Austin as the firm's principals.
The partner announcement says Anchorpoint clients work directly with Joe Munsayac and Austin to build programs around the company they have, not a cookie-cutter playbook. It lists the frameworks the firm supports—SOC 2, ISO 27001, ISO 42001, HIPAA, CMMC, HITRUST and others—alongside vCISO services and compliance readiness.
Advice before the sale is part of how compliance gets bought
Waters says they knew that building in compliance and trust with earlier-stage companies meant longer sales cycles, but did not expect to spend so much time helping founders decide whether to take compliance on at all.
Read more
Rather than push an immediate purchase, they explain what a founder should be doing now. The approach stretches the sales cycle, with the payoff of a founder positioned to act when the requirement becomes concrete rather than a faster close.
The same post points to the gap between first hearing the term and being ready for a platform—anywhere from a month to a year—as a reason the educational work matters more than a pitch.
Growth comes through relationships, partners and the local founder community
Waters measures progress through relationships rather than metrics.
Read more
A June conversation with Joe Munsayac about a shared observation became a formal place in the Openlane partner network.
The relationship centers on supporting mutual clients and a shared view of how compliance work should be done, not referral mechanics or pricing.
The same pattern runs through their community presence: panel appearances, customer meetings, partner conversations and introductions across the San Antonio founder network.
In a Startup Week reflection, Waters compares one year with the next: last year ended at Alamo Angels, meeting people willing to listen to a compliance explanation; this year ended at Alamo Ventures, catching up with familiar faces, introducing a fellow founder and offering to make an investor connection.
Over the year, the focus shifts from getting people onto the product to sharing what customers are doing with it and working with partners on mutual clients.
Openlane's own compliance and launch work is treated as public material
Across the posts, Waters points to Openlane's own work as an example: pushing a beta live, rebuilding the user experience from feedback, changing onboarding, sharing customer audit stories and finalizing evidence requests for the company's own SOC 2 audit while taking customer and partner meetings.
Read more
The company also describes its own compliance work in public.
The Startup Week post credits Matthew Anderson and Sarah Funkhouser with getting Openlane live before the event. It describes sharing stories of audits conducted in Openlane and how onboarding had changed since the beta.
Explains what changed in a year of building Openlane, as an early compliance platform moved from beta toward customers, audits, and partner conversations.
Read more
Kelsey Waters contrasts two San Antonio Startup Weeks.
A year earlier, the team was pushing to get Openlane fully live before the event, while the product was still in beta and the UX was being rebuilt from feedback.
They wanted people they met that week to be able to sign up and create an account instead of joining a waitlist, and credit Matthew Anderson and Sarah Funkhouser with making that happen.
This year, Openlane has customers.
They shared stories of audits being conducted on the platform, discussed changes to onboarding, and highlighted customer successes.
The post also describes customer meetings, conversations with partners about supporting mutual clients, and finalizing evidence requests for Openlane’s own SOC 2 audit.
For brands planning a campaign
A compliance platform can use this for startup-marketing content that turns operational milestones into credible lessons. Collaborate on founder-facing stories about beta-to-launch transitions, customer proof, event storytelling, or running a SOC 2 audit while serving customers.
Explains Kelsey Waters’s approach to compliance partnerships and why template-driven programs can be a problem for growing companies.
Read more
Kelsey Waters describes a June conversation with Joe Munsayac about a pattern they both saw: growing companies do not want a compliance program built from someone else’s template.
That conversation became a partnership, and they welcome Anchorpoint Partners to the Openlane partner network.
Anchorpoint is a boutique, founder-led cybersecurity and compliance firm whose clients work directly with Joe and Austin to build programs around the company they actually have, rather than follow a cookie-cutter playbook.
Anchorpoint supports companies across SOC 2, ISO 27001, ISO 42001, HIPAA, CMMC, HITRUST, and other frameworks, with vCISO services and compliance readiness.
They connect that approach to how Openlane was built: with the flexibility to create a security and compliance program that reflects how a company actually operates.
For brands planning a campaign
This supports co-marketing, partner-led education, or content comparing flexible compliance design with template-driven programs. A campaign could feature Kelsey Waters explaining partnership criteria, mutual client support, or how platform and services fit together for founders choosing a compliance path.
Answers a common founder question: whether to start compliance now or wait for a clearer business signal.
Read more
Kelsey Waters writes that building in compliance and trust with earlier-stage companies means longer sales cycles, but they did not expect to spend so much time helping founders decide whether to take on compliance at all.
Founders want to build smartly, affordably, and securely, and prepare for compliance requirements, but it often does not make sense to start until a clear signal appears: readiness to move into enterprise sales, preparation for a big enterprise POC, or signing a significant deal with a compliance requirement.
They note that the time between first hearing “SOC 2” and being ready for a platform might be a month or a year, and would rather help founders understand what to do now so they are well positioned when the requirement becomes real.
For brands planning a campaign
This offers top-of-funnel material for a B2B SaaS compliance platform: an educational collaboration on compliance timing, lead nurture for founders, a readiness checklist, or a webinar to help prospects decide what to do before buying a platform.
Waters describes spending much of their time helping founders work out whether to take on compliance at all, rather than selling a platform.
Read more
They name three signals that make the investment worthwhile: preparing to move into enterprise sales, gearing up for a large enterprise proof of concept, or signing a significant deal that carries a compliance requirement.
They also note that the gap between a founder first hearing the phrase “SOC 2” and being ready for a platform can be a month or a year.
They would rather help founders understand what to do in the meantime so they are positioned when the requirement becomes real.
Advice-first framing treats “not yet” as a legitimate answer and explains the trigger conditions instead of pushing an immediate purchase.
For brands planning a campaign
Supports collaboration built around founder education rather than product messaging: a readiness checklist, webinar or short guide on the signals that mean it is time to start, with the platform positioned as a guide rather than a pitch. This is the clearest topic in the posts for a B2B SaaS compliance platform to co-create around.
Compliance programs built around the company, not a template
In announcing Anchorpoint Partners joining the Openlane partner network, Waters describes the observation that started the relationship: growing companies do not want a compliance program built from someone else’s template.
Read more
Anchorpoint is described as a boutique, founder-led cybersecurity and compliance firm whose clients work directly with its principals to build programs around the company they actually have.
Waters ties that to how Openlane is built, framing flexibility as the shared value.
The post lists the frameworks Anchorpoint supports: SOC 2, ISO 27001, ISO 42001, HIPAA, CMMC, HITRUST and others, plus vCISO services and compliance readiness.
Uses a partner announcement to state a product and services philosophy, with the partner’s approach as proof.
For brands planning a campaign
A strong theme for co-marketing with services partners: content on tailoring controls and evidence to how a company actually operates, contrasted with copy-and-paste playbooks. Framework coverage listed in the post gives a concrete map of compliance areas a joint piece could address.
Building a partner network through direct outreach
Waters describes a June conversation with Joe Munsayac that started over a shared observation and eventually became a partnership, closing with a note that a LinkedIn message turned into something more.
Read more
The relationship is framed around supporting mutual clients and a shared view of how compliance work should be done, not referral mechanics or pricing.
Founder-to-founder outreach, followed by a public welcome once the partnership is in place.
For brands planning a campaign
Suggests a collaboration model that starts with a working relationship and shared point of view, then produces joint content. For a platform evaluating Waters as an advisor, this shows how they recruit and frame channel partners—useful if the collaboration involves an ecosystem or co-selling component.
Waters compares two San Antonio Startup Weeks a year apart.
Read more
Last year, the goal was to get Openlane live before the event so people they met that week could sign up rather than join a waitlist, while the product was still in beta and being rebuilt from feedback. This year, they were a panelist, took customer meetings, talked with partners about supporting mutual clients, and wrapped up the week catching up with familiar faces, introducing another founder and offering to make an investor connection.
Milestone reflection that measures progress through community involvement rather than metrics.
This post is personal and event-driven rather than a compliance explainer. Its value for a campaign is community credibility and local reach, not framework or product detail.
For brands planning a campaign
Points to event-based collaboration and regional ecosystem activation, including panel appearances and introductions across a founder network. A platform working with Waters could attach content to a startup-week or local founder audience rather than a purely online campaign.
Across the posts, Waters draws on Openlane’s own experience: pushing a beta product live, rebuilding the user experience from feedback, changing onboarding, sharing customer audit stories, and finalizing evidence requests for Openlane’s own SOC 2 audit.
Read more
The company’s internal compliance work is treated as something worth describing publicly.
Build-in-public storytelling that uses the company’s own compliance process as the example.
For brands planning a campaign
A platform could commission first-person content about running an audit from the inside, a different angle from vendor explainers that fits Waters’ habit of grounding points in what Openlane is actually doing. Ask whether they have more examples of Openlane’s SOC 2 evidence work to develop this direction.
Waters' posts name two businesses: Openlane, the compliance platform they describe as “we” and “our” while building it and its partner network, and Anchorpoint Partners, a cybersecurity and compliance firm they welcomed into that network.
Openlane
Disclosed partnership
Waters writes about Openlane as an insider — “we pushed hard to get Openlane fully live,” “we have customers on the platform,” “how we've built Openlane” — describing its beta, onboarding changes, customer audits, and SOC 2 evidence work.
Read more
Their posts don’t clarify whether they own the company or work there; ask them to confirm their relationship to Openlane.
Waters announced that Anchorpoint Partners joined the Openlane partner network, framing the move as the result of a June conversation with Joe Munsayac.
Read more
They describe Anchorpoint as a boutique, founder-led cybersecurity and compliance firm whose clients work directly with Joe and Austin, supporting SOC 2, ISO 27001, ISO 42001, HIPAA, CMMC, and HITRUST work plus vCISO services and compliance readiness.
Original disclosure
I'm glad to officially welcome Anchorpoint Partners to the Openlane partner network.
Kelsey Waters writes about when a growing company should take on compliance work and how to build a program around the company it actually has.
Read more
The material centers on early-stage timing decisions rather than framework-by-framework explanations, alongside a visible role in the San Antonio founder community and a partner network they help build.
For operational detail on a SOC 2 audit—policies, controls, evidence and timelines—readers can turn to Jacob Riff's posts.
Thomas Ward covers similar advisory ground in defense and government contracting compliance.
Mikaela Rivera uses a comparable first-person advisory approach, but in HR and recruiting rather than compliance.
Riff writes for founders working out how to handle SOC 2: how many policies and controls are involved, what the audit looks like and when a platform is worth paying for.
Read more
Like Waters, Riff treats a compliance platform as optional in principle and explains what needs to be in place before an audit.
Riff's posts are step-by-step operational walkthroughs of the SOC 2 process, and Riff is building a compliance platform, so the product sits close to the surface. Waters focuses on timing decisions, partner relationships and founder conversations, with less detail on controls or evidence collection.
Ward advises organizations on cybersecurity and compliance requirements, translates regulatory changes into practical next steps and focuses on maturing controls rather than chasing a certificate.
Read more
Ward's CMMC pause post and Waters' argument for waiting for the right signal both urge companies to keep doing the underlying work.
Ward's material targets the defense industrial base and government contracting, covering frameworks such as CMMC, NIST 800-171, DFARS and CUI, alongside fractional CISO and nonprofit leadership. Waters writes for earlier-stage commercial software companies deciding whether to begin compliance at all.
Rivera writes first-person advisory posts about reading patterns in how professionals communicate and show up, then turning those observations into practical next steps.
Read more
The teaching approach matches Waters' advice-from-observation style on founders and compliance timing.
Rivera's field is HR and recruiting, and the posts cover career search and interview communication. The connection is the advisory format, not the subject.
Placement decision: treat Kelsey Waters as a content-fit candidate for founder-facing compliance material, not an audience-proven channel.
Read more
The posts speak to founders of early-stage and growth-stage software companies weighing when to start compliance work, and to the security and compliance firms that serve them.
Topics include that timing decision, customer onboarding and audit stories inside Openlane, and a welcome for a boutique cybersecurity partner.
The only audience figure available is 2,935 LinkedIn followers, observed 9 October 2026.
Buyers can assess the subject-matter fit for a campaign aimed at founders considering compliance platforms, but not whether the readers are the buyers the campaign needs.
Before committing budget, request recent results for comparable posts and themes—impressions, engagement and follower growth—plus audience survey results or another documented source covering geography, seniority, company size and industry.
A follower count alone cannot establish those professional attributes.
No sponsorship, advertising, or paid-content format appears in the posts, and no official route for brand partnership inquiries is published.
Read more
The partnership activity runs the other way: Openlane is building a network of compliance and security firms.
The documented example is Anchorpoint Partners, a boutique, founder-led cybersecurity and compliance firm that joined the Openlane partner network after a June conversation between Kelsey Waters and Joe Munsayac.
Anchorpoint builds programs around each client’s business rather than a standard playbook, and supports SOC 2, ISO 27001, ISO 42001, HIPAA, CMMC, and HITRUST work, along with vCISO and compliance-readiness services.
A separate post describes introducing a fellow founder and offering to make an investor connection at an Alamo Ventures event—relationship building, not a purchasable format.
For a B2B SaaS compliance platform weighing a content collaboration, there is no published package, deliverable list, or rate, so scope, format, and terms would need to be defined in conversation.
The partnership language describes how Openlane works with service firms to serve mutual clients, not how Waters works with sponsors; the Anchorpoint announcement is not an available sponsored-content offer.
The same pattern appears in the October post about San Antonio Startup Week, where conversations about supporting mutual clients sit alongside customer meetings and the company’s own SOC 2 audit preparation.
Partner work appears to happen through direct conversations rather than a published program.
To assess a potential collaboration, ask about sponsorship terms, available formats, and how to submit a partnership inquiry.
A content and advisory collaboration for founders of early-stage and growth-stage software companies deciding whether to start compliance work.
Read more
Three things in Kelsey Waters’s posts support this.
First, the September post speaks directly to that reader: they say they spend much of their time helping founders decide whether to take on compliance, name the signals that make it worthwhile — preparing to move into enterprise sales, gearing up for a large enterprise proof of concept, or signing a significant deal that carries a compliance requirement — and treat “not yet” as a legitimate answer.
That is the same conversation a compliance platform’s prospects are having, so the subject matter fits a campaign aimed at those founders.
Second, the Anchorpoint post shows they can publish a point of view on how to build a compliance program — around the company a client actually has, not a template — and frame a partner relationship without turning it into a pitch.
Third, the Startup Week post shows a habit of turning operational milestones into first-person narrative: beta to live, onboarding changes, customer audit stories, and running Openlane’s own SOC 2 evidence work.
No sponsorship package, rate card, or partnership inquiry route appears in these posts; partner work runs through direct conversation, so scope and terms would need to be settled that way.
Advisory and co-produced education are the strong fit; these posts do not establish a packaged media buy.
When to choose a specialist
A campaign that depends on proven reach, measured engagement, or a documented paid format.
Read more
The only audience figure in these posts is 2,935 LinkedIn followers observed 9 October 2026; they provide no impressions, engagement rates, follower growth, or audience survey covering company size, seniority, or industry.
Ask for recent post performance and audience data before judging a campaign on audience volume or cost-per-impression.
A hard-sell product campaign to founders who are not ready to buy is also a poor fit.
The posts are advice-first and say plainly that starting compliance often does not make sense until a clear business signal appears, and that the gap between first hearing “SOC 2” and being ready for a platform can be a month or a year.
Pushing a purchase into that waiting period would cut against how Waters already talks to that audience.
The Anchorpoint announcement is not an available sponsored-content offer: it describes Openlane building a network of compliance and security firms to serve mutual clients, not a brand buying placement.
Ask for the sponsor policy or rate card before considering paid placement.
A worked campaign example
A B2B SaaS compliance platform wants to evaluate Waters as a startup-marketing advisor and propose a content collaboration.
Assessment: credible on subject matter and advisory angle, unproven on reach.
The posts show they speak to founders at the decision point the platform sells into and ground their points in what Openlane is doing, but provide no engagement or demographic data to support buying distribution.
Proposed collaboration: start with a co-produced founder-readiness resource — a short guide built around the three trigger signals named in the September post, covering what a founder should put in place during the month-or-a-year gap before a platform purchase makes sense — paired with a companion webinar or recorded walkthrough where Waters takes founders through that decision live.
Add Openlane’s own SOC 2 evidence work and customer audit stories as concrete illustrations of what the work looks like in practice.
A second asset, aimed at the ecosystem side, is a co-authored piece with an implementation partner on building a compliance program around the company a client actually has rather than a template, drawing on the Anchorpoint framing.
Campaign angle: position the platform as the guide founders turn to while they are still deciding, capturing attention before the buying trigger fires rather than competing for it afterward.
Settle format, deliverables, usage rights, and terms in conversation, since no published package or rate exists.
Before committing, ask for impressions and engagement for comparable posts, an audience survey covering company size, seniority, and industry, and any sponsor policy or partnership inquiry route.
Choose Thomas Ward when the platform wants a compliance advisor whose public voice already speaks to buyers with a defined regulatory trigger, rather than founders still deciding whether compliance is worth starting.
Read more
The July 14 post handles the Department of Defense pause of CMMC Phase II by answering the questions a contractor actually asks — whether to stop preparing, cancel an assessment, or treat NIST 800-171 as optional — and then lists what to keep doing: implement and mature NIST SP 800-171 controls, remediate gaps, write policies that hold up day to day, and prepare for future assessments.
It closes with a direct offer of a complimentary one-hour strategy call and a service list covering gap assessments, System Security Plans, PO&AMs, and fractional CISO work.
For a platform selling into the defense industrial base, that is a shorter path to a qualified conversation than a founder-readiness narrative, because the reader arrives already carrying a contractual requirement.
The October 5 post shows a second register: taking on the Interim Executive Director role at the Center for Creative Living and writing honestly about how business skills translate into nonprofit work and how the definition of success changes.
That range is useful if a campaign needs a named advisor who can speak about leadership and risk beyond a framework checklist.
The tradeoff is position and audience.
Thomas Ward writes as the expert a buyer hires, with a booking link and service menu attached, so a collaboration reads as sponsored expert placement rather than a peer telling founders what the work is really like.
The posts address defense contractors and organizations handling Controlled Unclassified Information, not early-stage software teams weighing their first SOC 2.
Compared with Kelsey Waters, who talks about the month-or-a-year gap before a founder is ready for a platform at all, Thomas reaches readers closer to purchase but with a narrower set of compliance frameworks and heavier service framing.
Ask about sponsorship formats, rates, and audience data before setting terms.
Choose Jacob Riff when the platform's hardest objection is the one its own prospects make: that a tool is not necessary.
Read more
The August 20 post walks a small team through what a SOC 2 audit actually involves — adding vendors and doing due diligence on each, writing roughly 20 policies and making them match how the company works, implementing about 100 to 150 controls, evaluating risk, deciding on a penetration test, and understanding that a Type I covers a single day while a Type II runs a three-to-six month observation period and repeats every 12 months.
It also notes that an engagement letter can keep a blocked deal moving while the work happens.
The August 6 post takes the objection head-on, quoting someone who called the work a waste of money, agreeing that a spreadsheet and a shared drive can get a company to an attestation, and then explaining what does not get counted: the hundred small tasks, the evidence collection and updating, and the risk of everything living in one person's head.
It ends by naming who the product was built for — the founder working at night after the kid is asleep.
For a platform, that combination of operational detail and willingness to argue against itself is unusually strong material to co-produce against.
The tradeoff is contested, competitor-facing ground.
The posts name Klaay, Vanta, and Thoropass, placing a collaboration inside a comparison already being argued in public.
The angle suits buyers deciding whether to buy anything at all rather than founders deciding whether to start compliance.
Kelsey Waters's posts sit one step earlier in the decision — the signals that make compliance worth beginning — and stay on Openlane's own build and customer stories instead of debating rival tools.
Jacob Riff's posts are tightly concentrated on SOC 2, serving that framework well but offering little for ISO 27001, HIPAA, CMMC, or HITRUST conversations.
Ask for sponsorship terms and audience figures before comparing reach or setting a rate.
Choose Mikaela Rivera when the collaboration needs to reach the person inside the buying company who will carry the readiness work rather than the founder signing off on it.
Read more
The May 29 post argues that success leaves clues and that high performers are identifiable by patterns — clear, responsive, and proactive communication, not leaving people guessing, responding with urgency, following through, and saying so when they do not have an answer — and turns that into advice for job seekers on how they show up in the rooms they want to be in.
The June 12 post describes the work itself: five days in the gym, packed days connecting with candidates and talking through opportunities, no two conversations alike, sometimes getting creative to make the pieces fit.
For a platform whose adoption depends on an operations, HR, or security lead driving the project internally, that is a different and complementary audience to a founder-facing compliance message, and it speaks to how readiness work gets staffed.
The tradeoff is that the subject matter does not overlap.
The posts focus on hiring, communication, and career decisions, so a collaboration would buy a trusted generalist people-and-culture voice while the platform supplied all the substance and compliance framing.
The reader is primarily a job seeker or hiring leader, not a buyer evaluating a compliance platform.
Compared with Kelsey Waters, who pairs compliance subject fluency with first-person accounts of running Openlane's own SOC 2 evidence work, Mikaela Rivera offers reach into the internal champion's mindset but no compliance credibility to lean on.
Ask about sponsorship formats, rates, and audience demographics before committing.
As of 9 October 2026, three full LinkedIn posts linked to Kelsey Waters cover helping founders decide when to start compliance work, welcoming Anchorpoint Partners to the Openlane partner network, and reflecting on a year between San Antonio Startup Week events.
The posts do not carry publication dates.
The profile showed 2,935 LinkedIn followers at that time.
No engagement metrics, audience demographics, or sponsorship formats are published in the posts here.
These posts do not establish whether books, shows, or earlier work also explain searches for the name, so that remains unclear.
