Hardest Part

Mapping disparate, unstructured evidence artifacts like screenshots and Jira tickets to strict compliance controls with zero false positives. Incorrectly evaluating a control's pass or fail status instantly destroys trust with the compliance team.

Min Viable Scope

Deliver continuous monitoring exclusively for SOC 2 Type II compliance within B2B SaaS companies hosted on AWS. Deliberately leave out ISO 27001, HIPAA, multi-cloud support, and automated remediation actions.

Cold Start Problem

The evaluation engine lacks the ground-truth data on what specific evidence auditors actually accept or reject during a live audit. Break this by partnering with two boutique audit firms to ingest their historical, anonymized evidence logs as the initial training set.

Time To First Value

2-3 weeks, gated by read-only integration with the customer's cloud environment and the ingestion of historical control evidence.

Data Moat Available

true

Technical Difficulty

High

Wedge

The beachhead is SOC 2 Type II evidence collection for Series B-D B2B SaaS companies using the standard AWS, GitHub, and Google Workspace stack. This niche requires immediate, recurring proof of compliance to unlock enterprise revenue, making the pain highly acute and the underlying tech stack predictable. Expansion moves horizontally into ISO 27001 and GDPR compliance for this exact same stack, and then vertically into automating the auditor's review process itself.

Timing

Large language models with long context windows and strict schema adherence now reliably parse messy API outputs from cloud infrastructure and map unstructured logs to rigid compliance frameworks. Previously, this required brittle custom API integrations that failed whenever underlying developer tools updated their interfaces.

Why This ICP

Mid-market SaaS companies face immense pressure to maintain compliance certifications to close enterprise deals but lack the dedicated compliance headcount of larger corporations. They experience acute financial pain when they must pull expensive engineers off core product development to gather access logs and take screenshots of configurations.

Size Of Prize

There are approximately 35,000 mid-market B2B software and cloud service companies globally that maintain SOC 2 or ISO 27001 certifications. At an average annual internal engineering labor and external auditor cost of $60,000 spent specifically on evidence collection and remediation per company, the addressable value is $2.1 billion.

Gap Narrative

Mid-market B2B software vendors undergo continuous security audits but rely on engineering teams to manually pull cloud logs, access rosters, and deployment tickets for evidence. Existing compliance platforms provide checklists and tracking but fail to execute the actual extraction and formatting of evidence from disparate engineering systems. These teams require an active extraction layer that retrieves, normalizes, and maps raw system data directly to auditor controls without human intervention.

Defensibility

Defensibility builds through workflow lock-in and a proprietary evidence-mapping database. As the system integrates deeper into a company's specific deployment pipelines and identity access configurations, replacing it requires reverting to manual engineering labor. The system also compounds its accuracy over time by learning exactly which specific log formats satisfy stringent auditor requests across hundreds of distinct audits.

Why This Thesis

Service-as-Software is the correct approach because these companies do not want another dashboard to track compliance tasks; they want the labor of evidence collection completely outsourced. An agentic service directly executes the extraction and formatting, replacing the internal engineering labor rather than just organizing it.

SAM

~$1B-1.5B US and UK mid-market banks and credit unions

SOM

~$30M-50M

TAM

~40k global financial institutions × ~$100k-150k/yr ≈ $4B-6B

Growth Rate

~12-18%/yr, driven by tightening global regulatory frameworks and increasing frequency of mandatory continuous audits

Paid Comparable Spend

~$80k-200k/yr spent on Big 4 external audit consulting fees, internal compliance analyst hours, and legacy GRC software modules

Kill Thresholds

• Security review blocks deployment in >50% of trial accounts
• Manual evidence upload accounts for >60% of activity at day 45
• Zero closed-won contracts >$80k ACV at day 90
• Sales cycle length exceeds 120 days for mid-market banks

Leading Metrics

• Days from contract signature to first automated control test
• Percentage of compliance framework controls mapped to automated data feeds
• False-positive rate on control failure alerts
• Weekly active days per internal audit user

What Proves Right

Target customers sign $80k annual contracts after a 30-day proof-of-concept. Compliance teams connect at least three core data environments within the first week to automate evidence collection. Cohorts show greater than 85 percent gross retention, with lead auditors logging in at least three days per week to review control statuses.

What Proves Wrong

Information security teams refuse to grant the platform read-access to production databases, permanently stalling deployments. The system generates excessive false-positive control failures, forcing analysts to manually verify alerts in Excel. Mid-market banks demand highly custom frameworks that require unscalable, heavy professional services to map and maintain.