Wedge

Target on-call engineers at mid-market B2B SaaS companies by handling non-critical warning-tier alerts. This low-risk beachhead allows the product to prove accuracy and reduce out-of-hours interruptions without risking production stability. Once trust is established, expand coverage to Sev-1 critical incidents and eventually generate automated remediation pull requests.

Timing

Recent advancements in long-context window models allow LLMs to ingest thousands of raw server logs, trace spans, and recent git commits simultaneously. Previous generations lacked the context capacity and retrieval-augmented reasoning required to map generic infrastructure alerts to specific code deployments.

Why This ICP

Site Reliability Engineers and DevOps teams operate under strict service level agreements where every minute of downtime equates to measurable revenue loss. They are highly technical buyers who readily adopt API-driven workflows to reduce severe alert fatigue.

Size Of Prize

There are approximately 150,000 mid-market and enterprise software organizations globally. At an estimated annual spend of $25,000 per organization for automated incident triage software, the total addressable prize is roughly $3.75B.

Gap Narrative

Current application performance monitoring tools generate high volumes of alert noise, forcing Site Reliability Engineers to manually correlate metrics, logs, and traces across multiple dashboards during an active outage. The missing component is an autonomous reasoning layer that parses the initial alert, executes diagnostic queries, and synthesizes a root-cause hypothesis before human intervention. This replaces the initial 30-minute manual investigation phase with instant context.

Defensibility

The product accumulates a proprietary knowledge graph mapping the customer's specific microservice architecture, historical incident resolutions, and unwritten diagnostic steps. As the agent observes more outages, its diagnostic accuracy becomes deeply entrenched in the idiosyncrasies of the customer's environment, creating a high switching cost.

Why This Thesis

An Agent-based approach fits the operational reality of incident triage, which inherently consists of sequential fetch-and-read actions. The agent executes read-only queries against observability platforms and code repositories, replicating the exact investigative workflow of a human responder.

Hardest Part

Correlating massive volumes of noisy, unstructured log data with APM traces to pinpoint a root cause without hallucinating false anomalies. High-stress, time-critical environments mean the acceptable error rate for misdirection is near zero.

Min Viable Scope

Limit the v1 to reading Datadog alerts and AWS Kubernetes logs to generate a root cause hypothesis and paste the relevant runbook link into Slack. Deliberately exclude automated remediation, script execution, or multi-cloud support.

Cold Start Problem

The model requires rich, context-specific historical incident data like post-mortems and Slack threads which companies guard fiercely. Overcome this by offering a read-only ingest tool for a single design partner to process their last 50 resolved P1 incidents.

Time To First Value

1-2 weeks to ingest and index historical runbooks and previous incident post-mortems before the first live triage.

Data Moat Available

true

Technical Difficulty

High

SAM

~$500-800M (English-speaking mid-market MSPs managing 5k+ endpoints)

SOM

~$10-25M

TAM

~120k global MSPs × ~$25k/yr allocated to L1 triage automation ≈ ~$3B

Growth Rate

~15-20%/yr, driven by rising offshore labor costs and exponential growth in endpoint security alerts

Paid Comparable Spend

~$45k-65k/yr per junior L1 dispatch technician or outsourced NOC seat

Kill Thresholds

• Technician override rate > 20% after 30 days of tuning
• Integration time > 40 hours for standard PSA tools
• L1 ticket automation rate < 25% at day 60
• Willingness to pay < $15k ACV after the initial 30-day pilot

Leading Metrics

• Time-to-first-automated-dispatch
• Percentage of L1 tickets routed without human intervention
• False-positive escalation rate
• Technician override rate per day

What Proves Right

Mid-market MSPs deploy the triage engine and route 40% of incoming L1 endpoint alerts to automated resolution or direct L2 escalation within 14 days of onboarding. Cohorts retain at over 90% beyond the first quarter, paying $25k ACV to directly offset outsourced NOC seats. Dispatch technicians actively reduce their manual ticket touches by half.

What Proves Wrong

The model fails to accurately categorize edge-case security alerts, driving a false-positive escalation rate above 15% that destroys technician trust. MSPs abandon the pilot and revert to manual routing because integration with legacy PSA tools requires more than 20 hours of custom configuration. Customers refuse to pay more than $5k annually because they classify the tool as a basic workflow script rather than a headcount replacement.