From YC Demo Day to Due Diligence: A Threat Model for Founder Ops & Vendor Sourcing (trust but verify)

Executive Summary — Early-growth startups—especially those in or adjacent to YC and recent Series-A networks—attract sophisticated social-engineering because they move fast, publish contact points, and adopt new tools quickly. This report documents a repeatable pattern: prospecting via friendly creator-style funnels (link-in-bio, generic intake forms, unauthenticated scheduling), requests for internal detail or assets, and a graceful exit when gated by NDA, verification, or objective capability proofs.Method — We convert common founder operations into enforceable security gates without slowing deals: NDA-first, identity & entity verification, acceptance-criteria proofs (e.g., Section 508 for federal work), and email authentication baselines (SPF/DKIM/DMARC). We provide an ATT&CK map, controls matrix, incident-evidence checklist, and a concise playbook for reporting.Key Controls — NDA-first; domain-email + W-9/EIN + (if federal) SAM UEI; objective capability proofs (e.g., 508-compliant tagged PDF with headings, alt text, contrast, table markup, metadata); ≤72-hour pilot SOW; DMARC p=quarantine/reject; dual-control vendor onboarding.Framework Mapping — MITRE ATT&CK (Recon → Resource Dev → Initial Access → Collection/Exfil), NIST CSF 2.0 (ID.GV, PR.AC, PR.AT, RS.AN, RS.CO), NIST SP 800-53 Rev.5 (PM-11, SA-4, PS-7, SC-7, SI-3, SI-8, AC-5, CM-3, PM-10).Data & Ethics — Examples were collected from lawful business communications; sensitive items are redacted; no system access was attempted.Sworn Statement — I, the undersigned author on behalf of Obelisk Tech Systems Inc., affirm that this manuscript is original; does not contain classified, export-controlled, or proprietary third-party data; and that all examples were obtained lawfully through routine business communications. All sensitive details are redacted or generalized. The views expressed are those of the authors and do not represent any government agency; no confidential client information is disclosed; and to the best of our knowledge there are no competing interests. — Signed: Authorized Representative, Obelisk Tech Systems Inc. — Date: 2025-09-09.Recommended Citation — Obelisk Tech Systems Inc. (2025). From YC Demo Day to Due Diligence: A Threat Model for Founder Ops & Vendor Sourcing (trust but verify). Zenodo. https://doi.org/10.5281/zenodo.17088394