# Vouch Core

*/Opportunities/Vouch_Core*

## Opportunity Overview

**Wedge**: Target SOC2 Type II report extraction for mid-market B2B SaaS buyers. This niche serves as the wedge because SOC2 reports are dense, standardized enough for reliable parsing, and mandatory for compliance. From this initial document extraction, expand into parsing custom security questionnaires, then ingest penetration test results, and ultimately automate the entire vendor risk assessment matrix.
**Timing**: Large context window models ingest entire 150-page SOC2 reports and data processing agreements simultaneously. Prior models required text chunking that broke the cross-document references necessary to verify if a specific technical control mitigates a stated risk.
**Why This I C P**: Mid-market InfoSec teams consisting of two to five analysts face strict compliance mandates but lack the budget to outsource vendor reviews to managed service providers. They experience the highest pain-to-headcount ratio, driving them to adopt automation rather than expanding headcount.
**Size Of Prize**: Approximately 40,000 mid-market US companies spend an average of $15,000 annually on internal InfoSec analyst labor for vendor security reviews, yielding a $600M addressable prize.
**Gap Narrative**: Mid-market InfoSec teams manually read hundreds of pages of vendor compliance documentation to complete risk assessments. Existing governance tools provide checklists but require humans to read the underlying SOC2 reports and extract the technical controls. Vouch Core reads the unstructured vendor documents and maps the extracted controls directly to the buyer's internal compliance requirements.
**Defensibility**: Vouch Core builds defensibility through workflow lock-in as it integrates into the core procurement approval routing. As the system processes more vendor documents, it builds a proprietary mapping of how specific unstructured vendor claims translate into the buyer's unique risk framework, creating a switching cost where replacing the system requires retraining a new tool on the company's specific compliance tolerances.
**Why This Thesis**: Service-as-Software matches the vendor review problem because buyers require a completed risk matrix and a binary approval decision rather than a new dashboard. Delivering the finished assessment directly into existing procurement pipelines removes the need for human analysts to operate the software.

## Opportunity Linked Thesis

**Thesis**: [Software](/Theses/Software)

## Opportunity Linked I C P

**Icp**: [Technology Startup](/CompanyTypes/Technology_Startup)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$500M-1B venture-backed Seed to Series C startups requiring D&O and Cyber
**S O M**: ~$30M-80M
**T A M**: ~150k US technology startups × ~$15k/yr average commercial insurance premiums ≈ $2.25B
**Growth Rate**: ~12-18%/yr, driven by increasingly stringent enterprise vendor compliance checklists and rising cyber liability baseline requirements
**Paid Comparable Spend**: ~$10k-25k/yr paid to legacy commercial insurance brokers for disjointed D&O, General Liability, and Cyber coverage policies

## Opportunity Incumbents

- [Crosschq References](/Products/Crosschq_References) — Tool
- [SkillSurvey References](/Products/SkillSurvey_References) — Tool
- [Sterling Screening](/Products/Sterling_Screening) — Service
- [Manual Phone Calls](/Products/Manual_Phone_Calls) — DIY
- [Tracking Spreadsheets](/Products/Tracking_Spreadsheets) — Spreadsheet
- [HireRight Verifications](/Products/HireRight_Verifications) — Service

## Opportunity Win Conditions

**Kill Thresholds**:
- Quote-to-bind conversion < 15% after 90 days
- Human-in-the-loop underwriting > 45% of standard applications
- CAC > $2500 per bound account
- Multi-policy attachment rate < 1.2 per customer
**Leading Metrics**:
- Quote-to-bind conversion rate
- Time-to-first-bound-policy
- Human underwriting escalation percentage
- Average policies attached per account
- Partner channel lead volume
**What Proves Right**: Startups complete the self-serve application and bind commercial coverage within 24 hours without broker calls. Companies add supplemental policies like Cyber and Directors and Officers coverage directly through the platform upon closing new funding rounds. Partnership integrations with startup accelerators and incorporation services generate direct inbound application volume.
**What Proves Wrong**: Founders abandon the digital application funnel and demand manual broker consultations to translate policy terms. The underwriting model requires human review for standard software or hardware business classifications. The cost to acquire a net-new bound policy exceeds the first-year premium margins.

## Opportunity Build Profile

**Hardest Part**: Preventing Sybil attacks and localized collusion rings where bad actors repeatedly vouch for each other requires enforcing strict identity verification without degrading the core onboarding conversion rate.
**Min Viable Scope**: Build exclusively for one tight professional vertical to enable peer-to-peer reputation attestations based on domain control. Deliberately leave out fiat identity document scanning, automated scraping, and third-party background check integrations.
**Cold Start Problem**: A vouch carries zero weight until the network contains recognized, high-reputation nodes. Break this by seeding the initial graph with a closed, highly vetted professional guild before enabling broad peer-to-peer invitations.
**Time To First Value**: 5 minutes to issue or receive a verified vouch, gated by initial identity verification and domain confirmation.
**Data Moat Available**: true
**Technical Difficulty**: Moderate

## Neighborhood

### Where the gap lives

- [Accounting Firm](/CompanyTypes/Accounting_Firm) — latent gap · CompanyTypes

### Incumbent in

- [Spreadsheet Tracking Logs](/Products/Spreadsheet_Tracking_Logs) — incumbent in · Products
- [Crosschq References](/Products/Crosschq_References) — incumbent in · Products
- [HireRight Verifications](/Products/HireRight_Verifications) — incumbent in · Products
- [Manual Phone Calls](/Products/Manual_Phone_Calls) — incumbent in · Products
- [SkillSurvey References](/Products/SkillSurvey_References) — incumbent in · Products
- [Sterling Screening](/Products/Sterling_Screening) — incumbent in · Products

### Applies thesis

- [Technology Startup](/CompanyTypes/Technology_Startup) — applies thesis · CompanyTypes

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### Similar Opportunities

- [Supplier Risk Assessment](/Opportunities/Supplier_Risk_Assessment) — similar · Opportunities
- [Vendor Risk Profiling for IT](/Opportunities/Vendor_Risk_Profiling_for_IT) — similar · Opportunities
- [Vendor Compliance Audits](/Opportunities/Vendor_Compliance_Audits) — similar · Opportunities
- [Vendor Vetting Service](/Opportunities/Vendor_Vetting_Service) — similar · Opportunities
- [Vendor Risk Service](/Opportunities/Vendor_Risk_Service) — similar · Opportunities
- [Vendor Assessment Automation](/Opportunities/Vendor_Assessment_Automation) — similar · Opportunities
- [Continuous Vendor Auditing](/Opportunities/Continuous_Vendor_Auditing) — similar · Opportunities
- [Nexus Monitoring Engine](/Opportunities/Nexus_Monitoring_Engine) — similar · Opportunities
- [Vendor Onboarding as a Service](/Opportunities/Vendor_Onboarding_as_a_Service) — similar · Opportunities
- [Automated Compliance Reporting Generation](/Opportunities/Automated_Compliance_Reporting_Generation) — similar · Opportunities
- [Vendor Loom](/Opportunities/Vendor_Loom) — similar · Opportunities
- [Vendor Risk Monitoring for Fintech](/Opportunities/Vendor_Risk_Monitoring_for_Fintech) — similar · Opportunities
- [Security Posture Evaluation for Banking](/Opportunities/Security_Posture_Evaluation_for_Banking) — similar · Opportunities
- [Due Diligence Responder](/Opportunities/Due_Diligence_Responder) — similar · Opportunities
- [Compliance Scrubbing for Healthcare Buyers](/Opportunities/Compliance_Scrubbing_for_Healthcare_Buyers) — similar · Opportunities
- [AI Supplier Validation](/Opportunities/AI_Supplier_Validation) — similar · Opportunities
- [Policy Audit Automation](/Opportunities/Policy_Audit_Automation) — similar · Opportunities
- [Compliance Reporting Engine](/Opportunities/Compliance_Reporting_Engine) — similar · Opportunities
- [Continuous Compliance Automation](/Opportunities/Continuous_Compliance_Automation) — similar · Opportunities
- [Compliance Audit Service](/Opportunities/Compliance_Audit_Service) — similar · Opportunities