# Automated Evidence Collection

*/Opportunities/Automated_Evidence_Collection*

## Opportunity Overview

**Wedge**: The beachhead is automating access review evidence collection for GitHub, AWS, and Okta within SOC 2 audits. This niche is highly standardized, universally required, and historically tedious to screenshot manually. Expansion moves from access reviews to change management evidence, and eventually extends into custom financial audit controls for pre-IPO companies.
**Timing**: Large language models combined with headless browser automation now reliably navigate complex, non-API-enabled internal dashboards to extract required proof. This removes the historic bottleneck of needing custom API integrations for every obscure internal tool.
**Why This I C P**: Mid-market B2B SaaS companies require SOC 2 and ISO 27001 certifications to close enterprise deals but operate with lean engineering teams. They feel the pain of evidence collection acutely because it pulls expensive developers away from shipping product.
**Size Of Prize**: There are roughly 40,000 mid-market B2B software and tech-enabled services companies in the US and Europe. At an average annual spend of $15,000 for compliance engineering labor and evidence-gathering tools, the addressable market is approximately $600M.
**Gap Narrative**: Mid-market compliance and engineering teams spend hundreds of hours manually gathering screenshots, logs, and configurations to satisfy auditor requests. Existing compliance platforms track control status but still require humans to manually upload bespoke evidence for custom controls or legacy systems. A fully autonomous system extracts this evidence directly from internal tools without human intervention.
**Defensibility**: Defensibility relies on workflow lock-in and a library of custom extraction models mapped to specific auditor requirements. Over time, the system accumulates thousands of edge-case integrations and auditor-approved evidence formats that are difficult for a new entrant to replicate quickly. However, the raw extraction capability is largely a commodity, meaning long-term moats require deep integration into the external auditor systems to create a true two-sided network effect.
**Why This Thesis**: An agentic approach directly mirrors the work of a junior compliance analyst. Instead of giving the ICP another dashboard to manage, the agent operates in the background, logs into systems, pulls the exact data the auditor requested, and deposits it in the required format.

## Opportunity Linked Thesis

**Thesis**: [Software](/Theses/Software)

## Opportunity Linked I C P

**Icp**: [B2B Software Company](/CompanyTypes/B2B_Software_Company)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$500M-800M US and EU mid-market B2B software vendors
**S O M**: ~$15M-30M
**T A M**: ~100k global B2B software companies × ~$20k-30k/yr ≈ $2B-3B
**Growth Rate**: ~20-25%/yr, driven by expanding enterprise vendor risk requirements and continuous compliance mandates
**Paid Comparable Spend**: ~$25k-50k/yr on compliance consultants, readiness assessments, and internal engineering labor spent manually pulling screenshots and system logs

## Opportunity Incumbents

- [Vanta Trust Management](/Products/Vanta_Trust_Management) — Tool
- [Drata Compliance Platform](/Products/Drata_Compliance_Platform) — Tool
- [Manual Evidence Spreadsheets](/Products/Manual_Evidence_Spreadsheets) — Spreadsheet
- [Big Four Auditors](/Products/Big_Four_Auditors) — Service
- [Internal Jira Ticketing](/Products/Internal_Jira_Ticketing) — DIY
- [Secureframe Evidence Automation](/Products/Secureframe_Evidence_Automation) — Tool

## Opportunity Win Conditions

**Kill Thresholds**:
- Fewer than 40 percent of customers connect their primary cloud provider within 14 days
- Manual evidence uploads exceed 30 percent of total artifacts collected after day 30
- Integration maintenance engineering cost exceeds $5000 per month per external platform
- Post-audit customer churn exceeds 15 percent due to perceived lack of ongoing value
**Leading Metrics**:
- Hours to connect first three external API integrations
- Percentage of compliance controls satisfied by automated evidence feeds
- Weekly volume of manual evidence upload fallbacks
- Auditor rejection rate of system-generated artifacts
**What Proves Right**: Customers connect their core identity, cloud compute, and version control providers within the first 48 hours of onboarding. The system maps infrastructure configurations to compliance controls without manual screenshot uploads, sustaining an annual contract value of $20,000. Month-to-month engagement shows users logging in only to review automated alerts rather than uploading manual evidence.
**What Proves Wrong**: Security teams refuse to grant read-only API access to production environments, forcing users to fall back on manual screenshot uploads. External auditors reject the system-generated evidence artifacts and demand raw system logs. The engineering cost to maintain brittle third-party API integrations exceeds the recurring subscription revenue.

## Opportunity Build Profile

**Hardest Part**: Maintaining reliable least-privilege integrations across constantly changing third-party APIs and normalizing heterogeneous JSON payloads into rigid auditor-acceptable evidence formats.
**Min Viable Scope**: Deliver exclusively for SOC 2 compliance against a strict tech stack of AWS, GitHub, Google Workspace, and Jamf. Deliberately leave out remediation ticketing, custom policy authoring, and legacy on-premise system connectors.
**Cold Start Problem**: Security teams block unproven tools from holding read-credentials for production infrastructure. Break this by deploying local-first collector agents that run within the customer VPC so credentials never leave their environment.
**Time To First Value**: 1-2 hours of onboarding, gated by the time required for IT admins to provision read-only service accounts and OAuth tokens.
**Data Moat Available**: false
**Technical Difficulty**: Moderate

## Neighborhood

### Where the gap lives

- [Business and Financial Operations Occupations](/Occupations/Business_and_Financial_Operations_Occupations) — latent gap · Occupations
- [Compliance Managers](/Occupations/Compliance_Managers) — latent gap · Occupations
- [Collect Audit Evidence](/Tasks/Collect_Audit_Evidence) — latent gap · Tasks
- [Application Software Publishing](/Industries/Application_Software_Publishing) — latent gap · Industries
- [Number of Repeat Findings](/Metrics/Number_of_Repeat_Findings) — latent gap · Metrics

### Incumbent in

- [Drata Automated Compliance](/Products/Drata_Automated_Compliance) — incumbent in · Products
- [Big Four Audit Firms](/Products/Big_Four_Audit_Firms) — incumbent in · Products
- [Vanta Trust Management](/Products/Vanta_Trust_Management) — incumbent in · Products
- [Manual Evidence Spreadsheets](/Products/Manual_Evidence_Spreadsheets) — incumbent in · Products
- [Secureframe Evidence Automation](/Products/Secureframe_Evidence_Automation) — incumbent in · Products
- [Internal Jira Ticketing](/Products/Internal_Jira_Ticketing) — incumbent in · Products

### Applies thesis

- [B2B Software Company](/CompanyTypes/B2B_Software_Company) — applies thesis · CompanyTypes

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### Similar Opportunities

- [Audit Request Fulfillment](/Opportunities/Audit_Request_Fulfillment) — similar · Opportunities
- [Assurance Node](/Opportunities/Assurance_Node) — similar · Opportunities
- [Compliance Reporting Automation](/Opportunities/Compliance_Reporting_Automation) — similar · Opportunities
- [SaaS Audit Evidence Extraction](/Opportunities/SaaS_Audit_Evidence_Extraction) — similar · Opportunities
- [Audit Compliance Guard](/Opportunities/Audit_Compliance_Guard) — similar · Opportunities
- [Continuous Audit Compiler](/Opportunities/Continuous_Audit_Compiler) — similar · Opportunities
- [Compliance Audit Agent](/Opportunities/Compliance_Audit_Agent) — similar · Opportunities
- [Automated Audit Record](/Opportunities/Automated_Audit_Record) — similar · Opportunities
- [Compliance Audit Defender](/Opportunities/Compliance_Audit_Defender) — similar · Opportunities
- [Automated Compliance Verification](/Opportunities/Automated_Compliance_Verification) — similar · Opportunities
- [Continuous Audit Defense](/Opportunities/Continuous_Audit_Defense) — similar · Opportunities
- [Continuous Audit Compliance](/Opportunities/Continuous_Audit_Compliance) — similar · Opportunities
- [Compliance Reporting Engine](/Opportunities/Compliance_Reporting_Engine) — similar · Opportunities
- [Audit Shield Desk](/Opportunities/Audit_Shield_Desk) — similar · Opportunities
- [Continuous Compliance Audit](/Opportunities/Continuous_Compliance_Audit) — similar · Opportunities
- [Cross-System Audit Mapping for Compliance Teams](/Opportunities/Cross-System_Audit_Mapping_for_Compliance_Teams) — similar · Opportunities
- [Continuous Evidence Gateway](/Opportunities/Continuous_Evidence_Gateway) — similar · Opportunities
- [Autonomous SaaS SOC2 Auditing](/Opportunities/Autonomous_SaaS_SOC2_Auditing) — similar · Opportunities
- [Automated Evidence Mapping](/Opportunities/Automated_Evidence_Mapping) — similar · Opportunities
- [Compliance Assessment Agent](/Opportunities/Compliance_Assessment_Agent) — similar · Opportunities