When Compliance Becomes a Cover-up

On paper, this agency was doing great.

Over a decade old, roughly 100 employees, industry awards lining the walls. Their crown jewel was a multi-brand relationship with a Fortune 500 conglomerate covering more than a dozen brands under one roof. The kind of anchor client that makes a mid-market shop look enterprise-grade.

Estimated annual revenue: €8-10 million. The anchor client alone brought in over €7M.

The pencil-whipped audit

For years, the agency’s security compliance had been a formality. When clients asked for security questionnaires, someone in operations filled out a spreadsheet and marked “Yes” on nearly every control. Whether those controls existed didn’t really come up. No penetration testing, no documented incident response, no access reviews. The answers were good enough on paper, and nobody asked for evidence.

The founder/CEO thought this was fine. They had been doing it for years without anyone pushing back. Why would they start now?

But the conglomerate got new procurement leadership. And new leadership asked for something different: a proper ISO 27001-style assessment, conducted by a third-party auditor with electronic submissions and evidence requirements. Not a spreadsheet you could pencil-whip in an afternoon.

The assessment

The agency brought in an outside team to conduct the evaluation, a technology partner that had been working on their platform for years, alongside a third-party security assessor who would later become a founding partner of Thorian Security.

The assessment covered six domains. Every single one came back with material gaps.

Access controls were a mess. Shared credentials, no role-based permissions, no segregation of duties.

Data handling was worse. Unencrypted sensitive data at rest and in transit, no classification policy.

Incident response? No documented process, no testing, no tabletop exercises.

Vendor risk was ignored. No third-party security assessments of their own suppliers.

Employee training was nonexistent. No security awareness program, no phishing simulations.

Physical security was inadequate. Poor workspace access controls, unmanaged device security.

This wasn’t a “few things to tighten up” situation. The entire security posture was ad-hoc.

What happened next

The assessment team presented the findings along with a remediation plan. Prioritized by risk, realistic timeline, clear cost estimates. The technology partner was prepared to do the work.

The founder/CEO went the other direction.

First, the assessment team was cut off, one line item at a time. The agency leaked in an internal channel that the firm was “not to be trusted” and ordered them excluded from all client contact.

Then came the decision that would cost the company its anchor client.

They submitted the assessment survey as all-passing. With a note stating the flagged items were “being remediated.” Which was false. Nothing was being remediated. The founder/CEO told the team the relationship with the conglomerate was strong enough to skate by. They could take their time fixing things, or not fix them at all.

The strategy was to wait for someone at the conglomerate to notice, then hope that person didn’t push back.

The timeline

In 2024, the agency submitted pencil-whipped security questionnaires to the conglomerate. All “pass.” No evidence requested.

Early 2025, the conglomerate’s procurement team mandated a proper third-party security assessment. Not a spreadsheet, an electronic audit with evidence requirements.

Mid 2025, the assessment completed. Six domains, all with material gaps. A remediation plan was presented with cost estimates and timeline.

Still mid 2025, the founder/CEO cut off the assessment team and submitted a false “all-passing” survey with “under remediation” notes.

Late 2025, the conglomerate verified the claims. The gap between what the agency claimed and what actually existed became clear.

Early 2026, the conglomerate terminated the relationship. The agency lost its largest client, over €7M in contracts, the majority of total revenue. Headcount dropped from roughly 50 full-time to under 10. Everyone else went contract or went home.

Mid 2026, the agency is pitching another major brand. The same compliance requirements will apply. The security posture has not changed.

The numbers

The remediation plan would have cost the agency €35K. That was the actual quote to fix every single issue identified in the assessment.

Instead, they lost €7M+.

A €35K investment to protect €7M in revenue is a 200x return. Lying on a compliance questionnaire cost them 100% of it.

What this tells us

Pencil-whipped compliance is a time bomb. Filling out security questionnaires without evidence works right up until the client asks for proof. When procurement upgrades from spreadsheets to audits, the gap between what you claimed and what you built becomes the only thing that matters.

Enterprise clients verify. Fortune 500 procurement teams don’t take your word for it. They audit, they verify, they ask for evidence. The era of self-reported compliance is ending.

Deception costs more than remediation. The remediation plan had a price tag of €35K. The cover-up cost the company its largest client, €7M+. The ratio is roughly 200 to 1 in favor of doing the work.

And the agency is already pitching another major brand. The security posture hasn’t changed. The leadership hasn’t changed. The same compliance requirements will come up. The pattern is likely to repeat.

What Thorian does differently

We tell you what we find, not what you want to hear. We build the controls and document them, so you can actually prove it. And we don’t hand you a report and walk away, we close the gaps.

Thorian was founded because we watched a company with genuine potential get destroyed. The product was fine. The leadership chose deception over compliance, and that was enough to lose everything. We exist so other companies don’t make the same mistake.

If you’re facing a compliance requirement and feeling overwhelmed, that’s normal. If your instinct is to hide it, that’s dangerous. Call us instead.

---

This case study is anonymized. The agency, its founder/CEO, and client have been described generically to protect privacy. Revenue figures are based on actual contract values. The facts of the assessment, the response, and the outcome are accurate.