This deck is built for a horizontal screen. Turn your device sideways for the full view.
Built for the 33 million companies everyone else ignored.
Security, Compliance & Risk Management for SMBs
ANGEL ROUND | AUGUST 2026
"Can you fill out this
security questionnaire?"
A 200-question spreadsheet. Due Friday.
You understood maybe half of it.
"Do you have a
security policy?"
Data handling. Access control.
Incident response. You have none of them.
"Are you SOC 2
compliant?"
Enterprise clients need it. You Googled it.
It costs $50K+. You have $0 budgeted.
of SMBs lost a deal due to
missing security certification
A-LIGN 2024
of investors factor cyber
maturity into valuation
Marsh & McLennan 2023
of M&A deals derailed
by security gaps
Westbourne Partners 2025
Lost deals. Stalled partnerships. Raises that fall apart in due diligence.
WHY NOW
Every enterprise buyer now demands SOC 2
It's table stakes for any B2B deal over $50K. SMBs are scrambling.
AI is creating new attack vectors daily
Boards that ignored cyber risk two years ago are now asking about it every quarter.
The market is enforcing what regulators won't
Insurers, investors, and enterprise buyers all require proof of security posture now — regardless of what Washington does.
Nobody's built for the companies getting hit hardest
The incumbents went upmarket. 33M+ SMBs are on their own.
Phase 3 — Data network plays here
Phase 2 — Risk infrastructure expands here
Phase 1 — Compliance wedge starts here · ~6,000 SMBs at $8.4K ACV
Year 1 capture: ~1% → $527K ARR
Every other tool asks "are you compliant?" We ask: "What happens to your revenue, your pipeline, and your next raise if you're not?" Then we build from there.
BUSINESS CONTEXT FIRST
"Is this really that big of a deal?"
We map risk directly to the metrics you actually care about — deal velocity, renewal rates, valuation impact. Not abstract threat scores. Real business outcomes.
RISK IN DOLLARS
A number your board can act on
FAIR-based quantification turns "we might get breached" into "$340K in annualized exposure, reduced to $85K." That's a conversation a CEO can have with anyone.
ALWAYS READY
The questionnaire lands. You're already done.
Continuous compliance, auto-generated policies, and a living security posture that updates as your business changes. Not a binder on a shelf.
Five modules. Continuous monitoring. Risk quantified in dollars — not traffic lights.
of executives agree: measuring cyber risk is essential.
actually measure the financial impact.
59% of SMBs experienced a cyberattack in the past year (Hiscox, 2025). 86% of breaches disrupted operations — halting sales, service and production (IBM, 2025).
WHY THE GAP?
The math requires a team they don't have
CRQ sits at the intersection of cybersecurity, finance, and statistics. 65% of CRQ market revenue comes from large enterprises — because they're the only ones with staff to run the models.
You can't measure a program that doesn't exist
Every CRQ tool on the market assumes a security baseline — vulnerability scanners, asset inventories, threat intel feeds. 33 million companies don't have that infrastructure.
The output is a report, not a next step
Enterprise CRQ produces a PDF for the board. vCISO Lite produces the program, the measurement, and the action plan — all in one.
They're already spending — just blind
58% of SMBs overspent on cybersecurity last year. 83% still aren't prepared to recover financially. The money is flowing — it just has nowhere intelligent to go.
Source: JumpCloud, 2025 · Gartner, 2024 · ConnectWise State of SMB Cybersecurity, 2025
Compliance tools tell you if you passed. CRQ tells your investors, acquirers, and enterprise partners what your risk is worth in dollars — the language deals actually get done in.
SMB + RISK LANGUAGE
Compliance + financial risk narrative for deals, M&A, and fundraising
ENTERPRISE + RISK LANGUAGE
$100K+/yr. Requires dedicated CISO.
SMB + COMPLIANCE ONLY
Pass/fail. No risk narrative. Can't answer "what's your exposure?"
ENTERPRISE + COMPLIANCE ONLY
Proven demand. Enterprise pricing. Moving downmarket slowly.
WE MEET YOU WHERE YOU ARE
Sometimes the badge is enough to close the deal. We get you there.
Sometimes you need to show the gaps and what you're doing about them. We do that too.
THE REAL MOAT: DATA GRAVITY
Anyone can build a CRQ engine. Nobody can replicate 12 months of your risk history, policy evolution, and board reports. Every day on the platform makes switching harder — and our data more valuable.
$3.6B in exits prove demand.
We serve who they can't.
PRODUCT MIX EVOLUTION & GROWTH — hover for details
AI-INDEXED CONTENT
40 SME blog posts already live, optimized for AI search + traditional SEO. ProductHunt and G2 listings at launch.
~35%
of Year 1 pipeline · ~10 customers
FOUNDER & ANGEL NETWORKS
YC, Techstars, indie hackers + angel communities. Warm intros from investors who back the same stage we serve.
~30%
of Year 1 pipeline · investors → intros
Where you come inPRODUCT-LED VIRALITY
Every trust page, compliance badge, and questionnaire response carries our name. Free risk snapshot as top-of-funnel magnet.
~20%
of Year 1 pipeline · compounds over time
WARM REFERRAL NETWORK
2–3 informal relationships by Q4: a fractional CFO, an accountant, an MSP. Simple rev share — no formal program yet.
~15%
of Year 1 pipeline · scales fastest in Year 2
Q3 '26 — 5 customers
Round closes. Enterprise tier ships. Founder-led sales from personal network. Validate positioning + pricing.
Q4 '26 — 15 customers
AI content driving inbound. G2 listing live. Free risk snapshot launched. First case study published.
Q1 '27 — 41 customers · $470K ARR
First enterprise design partner lands via partner channel. Referral partners active. Self-serve Starter.
Q2 '27 — 72 customers
$902K ARR. 2 enterprise customers via partner channel. Product-led + referrals growing. Upsell motion active.
Phases 1, 2 & 3 shipped. Platform automation launching July 9. Trust credentials next.
Foundation
✓ Compliance Engine — policy, FAIR-based CRQ, SOC 2 readiness
✓ Risk Infrastructure — continuous scoring, automated evidence
✓ Multi-framework mapping · executive dashboards
Compliance Engine Q4 '25
Risk Infrastructure Q1 '26
Enterprise Intelligence
Automated KRI derivation from dependency graphs
AI-powered risk queries — natural language, 25+ tool integrations
Quantitative incident response (conditional probability modeling)
Executive posture dashboards with $ exposure
$8,499/MO · 500–2,500 EMPLOYEES
Shipped Q2 '26 · Partner channel (partial)
Platform Automation
Trustworthy Automation — the agent that runs the platform
Autonomous execution across compliance, risk, intelligence layers
Eval harness keeps it honest — scope expands after each check passes
Human-in-the-loop for anything with material impact
TRUSTWORTHY AUTOMATION
Live since July 2026 · Beta expanding Q3 '26
Portable Trust Credentials
SMB owns their verified risk posture — shares it on their terms
Flash it to close a deal, get a better insurance rate, pass due diligence
Carfax for business trust — the seller shares it because it helps them sell
WHY US, NOT BITSIGHT
They rate you whether you like it or not.
We arm you with proof you control.
$21B TAM — the SMB is always the customer, never the product
130% NRR driven by phase-based upsell + enterprise expansion
PROOF OF VELOCITY
2 phases shipped
Compliance engine + risk infrastructure — in production, not on a roadmap
40 posts indexed
SME content optimized for AI search + traditional SEO, driving inbound traffic
$0 outside capital
Everything here was built bootstrapped on a lean ~$2,400/mo burn. We run to one number, the Default-Alive Ratio, and this round is the fuel to compound past it.
WHAT THIS ROUND BUYS
Month 3 — 5 customers
Design partners. Validate pricing. ProductHunt launch.
Month 6 — 15 customers
AI content driving inbound. G2 listing live. First case study.
Month 9 — 41 customers
First enterprise partner lands. Self-serve onboarding. Trust page virality.
Month 12 — 72 customers · $902K ARR
Seed-ready. Product-led growth compounding. Upsell motion live.
Yolonda Smith, CISM
Founder & CEO
12–18 months to find our repeatable revenue motion, reach default-alive, and earn a seed. The product is already built; this capital buys the path to revenue, not the build.
WHAT IT BUYS
Founder, full-time
Off personal savings and fully on customers. A paid founder is a focused one, and it is the highest-leverage dollar in the round.
One full-stack engineer
A full-time builder who owns the product end-to-end, so the founder isn’t spec’ing and QA’ing a contractor instead of selling. Hire #1, funded at the top of the range.
Go-to-market experiment
Scale the 40-post content engine, test paid acquisition, add sales tooling. The real job of this round: find the repeatable motion to hire a seller against at seed.
Lean infra + buffer
Hold the ~$2,400/mo burn steady and keep a contingency reserve. Capital efficiency is the strategy, not an afterthought.
Looking for angels who understand B2B SaaS and compliance.
Use of
Funds
| QUARTER | CUST | STARTER | GROWTH | BUSINESS | ULTRA | ENTER. | SAAS ARR | SVC REV | TOTAL | wACV |
|---|---|---|---|---|---|---|---|---|---|---|
| Q2 '26 | 0 | 0 | 0 | 0 | 0 | 0 | $0 | $0 | $0 | — |
| Q3 '26 | 5 | 2 (40%) | 2 (30%) | 1 (20%) | 0 (10%) | 0 (0%) | $34K | $10K | $44K | $6,800 |
| Q4 '26 | 15 | 5 (35%) | 4 (28%) | 3 (22%) | 2 (15%) | 0 (0%) | $119K | $15K | $134K | $7,933 |
| Q1 '27 | 41 | 12 (30%) | 11 (27%) | 10 (25%) | 7 (18%) | 1 (2%) | $470K | $57K | $527K | $11,463 |
| Q2 '27 | 72 | 18 (25%) | 18 (25%) | 21 (30%) | 14 (20%) | 2 (3%) | $902K | $85K | $987K | $12,528 |
| Q3 '27 | 98 | 21 (22%) | 23 (24%) | 30 (32%) | 21 (22%) | 3 (3%) | $1.28M | $177K | $1.46M | $13,082 |
| Q4 '27 | 125 | 22 (18%) | 26 (22%) | 42 (35%) | 30 (25%) | 5 (4%) | $1.82M | $231K | $2.05M | $14,560 |
| Q1 '28 | 158 | 22 (15%) | 32 (21%) | 56 (37%) | 40 (27%) | 8 (5%) | $2.52M | $270K | $2.79M | $15,924 |
| Q2 '28 | 192 | 18 (10%) | 36 (20%) | 72 (40%) | 54 (30%) | 12 (6%) | $3.38M | $323K | $3.70M | $17,604 |
| Q3 '28 | 226 | 21 | 38 | 84 | 67 | 16 (7%) | $4.19M | $502K | $4.69M | $18,540 |
| Q4 '28 | 265 | 24 | 44 | 98 | 78 | 20 (8%) | $5.02M | $590K | $5.61M | $18,943 |
| Q1 '29 | 305 | 28 | 48 | 112 | 92 | 25 (8%) | $5.99M | $672K | $6.66M | $19,639 |
SaaS tiers: Starter $299 · Growth $599 · Business $999 · Ultra $1,499 · Enterprise $8,499/mo
Services: Kickstart $5K · Audit Prep $7K · Quarterly vCISO $5.5K/qtr · Fractional vCISO $8K/mo
SaaS ARR + Other20 services revenue by quarter. Services attach as trust deepens.
YEAR 1
$527K
41 customers · $470K SaaS + $57K svc
YEAR 2
$2.79M
158 customers · $2.52M SaaS + $270K svc
YEAR 3
$6.67M
305 customers · $5.99M SaaS + $672K svc
OTHER20 SERVICES
Kickstart $5K · Audit Prep $7K
Quarterly vCISO $5.5K/qtr
Fractional vCISO $8K/mo
~10% of total revenue by Y3
Original research driving the platform's core IP — plus the industry references that validate the problem.
ORIGINAL RESEARCH
WHITEPAPER
Calibrated Risk Tolerance Framework (CRTF)
Quantitative cybersecurity risk appetite from business context. Bridges FAIR with calibrated probability assessment for SEC Item 106 compliance.
WHITEPAPER
Dual-Path Policy Drift Detection
Routes policy requirements to deterministic enforcement or statistical drift evaluation. Three-tier evidence model with composite drift scoring.
WHITEPAPER
DC-TPIR: Dependency-Centric Third-Party Incident Response
Extends FAIR to post-incident exposure. Conditional probability decomposition for vendor triage. Institutional memory for repeat vendor events.
ENTERPRISE RESEARCH
ACADEMIC PAPER
KRIE: Dependency-Aware KRI Derivation & Calibration
Automated KRI derivation from vendor dependency graphs. Calibrated thresholds via superforecasting. Conditional probability integration for cascade risk.
TRUSTWORTHY AUTONOMY (TAC)
The unsolved problem for autonomous compliance agents isn't capability — it's proving they can be trusted to act. TAC is a two-gate certification framework and contamination-resistant benchmark for GRC agents. Published methodology, not vendor self-report.
Accepted SSRN · June 2026 · Foundation for Platform Automation (July 9)
INDUSTRY VALIDATION
NACD Cyber Risk Oversight
Directors must approach cybersecurity as a strategic enterprise risk — not an IT problem. Boards need financially-oriented tools that measure effectiveness.
WEF Global Cybersecurity Outlook 2025
72% of organizations report increased cyber risk. Supply chain complexity is the #1 concern. SMBs disproportionately affected.
IBM/Ponemon Cost of a Data Breach 2024
Average breach cost: $4.88M (+10% YoY). Organizations using AI-based security tools saved $2.2M per breach on average.
Verizon DBIR 2025
Ransomware present in 44% of breaches (+37% YoY). SMBs are the fastest-growing target segment.
This isn't a product looking for a problem — the research, the regulations, and the data all point the same direction
Executives overwhelmingly agree that measuring cyber risk is essential. Almost none do it in financial terms. Here's why — and why it matters most for SMBs.
WHY 88% BELIEVE IT'S ESSENTIAL
Fiduciary obligation
SEC disclosure rules now require boards to describe cyber risk oversight. CISOs mentioned in 70% of annual disclosures (up from 28%). Directors face derivative lawsuits.
Capital allocation
$4.44M average breach cost globally. $10.22M in the U.S. AI-driven security saves $1.9M per breach. Quantification turns "IT problem" into boardroom math.
Regulatory convergence
SEC Item 106, DORA (EU), CPS 230 (AU) — all converging on "prove you understand your exposure." Measuring risk is a compliance prerequisite.
WHY ONLY 15% QUANTIFY
Hard math, no staff
CRQ requires cybersecurity × finance × statistics. 65% of CRQ market revenue comes from large enterprises — the only ones with teams to run the models.
No infrastructure to feed it
CRQ needs vulnerability scanners, asset inventories, threat intel feeds — all talking to each other. 33 million companies don't have that baseline.
Output is a PDF, not a program
Enterprise CRQ produces a report for the board. It doesn't build the security program, measure it, or tell you what to do next.
SMB REALITY
Under attack
59% experienced a cyberattack in the past year (Hiscox, 2025). 86% of breaches disrupted operations — halting sales, service and production (IBM, 2025).
Aware but spending blind
78% fear a breach could end the business. 57% say it's their top priority. 58% overspent on cybersecurity last year — with no way to know if it worked.
The bridge
$12K/year in preventive measures delivers 11× ROI. But 83% aren't prepared to recover. The money is flowing — it just has nowhere intelligent to go. That's vCISO Lite.
Sources: IBM 2025 · PwC Global Digital Trust Insights 2025 · ConnectWise State of SMB Cybersecurity 2025 · JumpCloud 2025
$8,499/mo · Market comps run $75–100K/yr · 500–2,500 employees
VENDOR INCIDENT RESPONSE
SHIPPED Q2 '26Vendor breach hits. Your options are already on the table.
Options modeled to your risk tolerance. Every decision defensible to the board.
BUSINESS CONTINUITY & RESILIENCE
SHIPPED Q2 '26"What if Okta goes down for 24 hours?" Answer in dollars.
Dependency mapping · Scenario simulation · Concentration risk detection
KEY RISK INDICATORS
Replace the quarterly risk review with a number that updates daily.
Auto-derived from dependency graph · Calibrated thresholds · Board-ready
EXPERIENCE LAYER
AI-Powered Risk Intelligence
All three capabilities, conversational. Users interrogate risk data in plain English — vCISO Lite becomes a trusted advisor, not a dashboard.
25+
MCP TOOLS
Shipped Q2 '26 via partner channel (partial) · 30 enterprise customers → $3.06M ARR by Q1 '29
Slide 12 introduced the engine. The surface area on top of it is eleven products, named for what each one is for and who buys it. Same Foundation underneath every surface — different protocols, different buyers, different deployment models.
Gold is the diligence surface from Slide G. It runs QCD — a five-pillar framework that produces CCOD: a single dollar figure expressed against enterprise value.
Outcome: Q99 above 15% of EV triggers structural intervention — price adjustment, R&W escrow, or walk. Findings move deal terms.
METHODOLOGY · Appendix D
BOOK · Someone Else's Debt · Amazon · Leanpub
Most demos. Ours ship. Marketplace-listed, enterprise-authed, methodology-published — and both sit on the same evidence base.
Titanium
APRI Gateway · MCP platform
Bring vCISO Lite into any agent's workflow.
Compliance queries from Claude, Cursor, or any MCP client
Ship risk operations as first-class tools in your IDE
Zero-friction developer + partner onboarding
69 tools live at mcp.vcisolite.com · Anthropic + Cursor marketplaces
Platinum
Trustworthy Automation · agentic layer
Run the platform itself. Prove it's doing the right thing.
Automated compliance actions with statistical guarantees
Audit-grade attestation for every autonomous decision
Human-in-the-loop only where it materially matters
TAC framework (SSRN, June 2026) · Live July 2026
THE EVIDENCE GRAPH · FOUNDATIONAL IP
The foundation under both surfaces.
Every model call, tool invocation, policy decision — signed at write time, causally linked, replayable end-to-end. What makes trustworthy autonomy claimable, not asserted.
Foundation for Slide 12's Portable Trust Credentials (Phase 04).
Rhodium is the audit-firm surface from the metal family map. The Big Four, regional, and specialist firms manage their book of client engagements in vCISO Lite alongside the customers being audited.
Outcome: One firm runs 38 engagements across 22 customers. APRI builds the sample packs, chains them to last year's, surfaces the book-level signals — partners read summaries, not dashboards.
STATUS · Design partners 2H 2027 · GA 2H 2028
METHODOLOGY · Evidence Graphs working paper v0.2
