ONE STEP AWAY
One fix away from launch-ready.
- Market
- 48
- Demand
- 55
- Competition
- 42
- Moat
- 40
- Model
- 52
- Regulatory
- 42
Score is the median of three independent grader runs. It rates the idea; the proof level says what the founder has already achieved.
Nothing in the brief stops IntelliGRC, Apptega, Paramify or a sub-$5,400 tool from copying NIST 800-171 mapping, SPRS scoring and evidence export, and MSP lock-in is untested.
The brief ignores the July 13, 2026 Phase II suspension, the cost of hosting evidence that may hold CUI (possibly FedRAMP Moderate or equivalent), and the unknown MSP margin that sets your real net price.
6 things the AI guessed
Check them. Correct any in the Refine tool and the report re-runs.
- The product is a web-based SaaS, not a mobile app or a managed service. (The type was not stated. It sets build cost, how the product is delivered and what a buyer expects.)
- The market is the United States only. (Region was not stated. CMMC, SPRS and the 48 CFR rule are US DoD rules, so this sets market size and legal scope.)
- The MSP is the paying buyer and resells or refers the product, and the subcontractor is the end user. (The brief says the MSP is the channel but not who pays. This changes sales cycle, MSP margin and net revenue per customer.)
- The $5,400 price is per subcontractor per year, with done-with-you onboarding included. (If onboarding is extra or the price is per MSP, revenue and cost to serve change a lot.)
- The incumbent price range of $7,500 to $40,000 a year is the founder's own figure and has not been verified. (The low-price pitch rests on this gap. If incumbents offer small-firm plans, the advantage shrinks.)
- The founder is early stage, with no paying customers or signed MSP partners yet. (Nothing in the brief shows traction. Scoring should treat demand and channel fit as unproven.)
The bottom line
You are not competing on features. You are competing for MSP attention and trust. MSPs already buy per-client compliance tools, and IntelliGRC ($3.5M seed, Jan 2026) and Apptega ($15M raise, 2024) are built for them. One MSP-focused source lists Cyber Verify at $99 to $299 per client per month, which is $1,188 to $3,588 a year. That is below your $450 a month. I could not confirm it on the vendor's page. Paramify's Level 2 plans run $8,000 to $25,000 a year, per a review site that may take referral pay. So $5,400 sits between two price anchors with no proven reason to pick it. Your edge would have to be a simpler setup for small MSPs, or evidence handling that is clearly better. The brief does not show either yet.
The pain is real. Small firms find CMMC costly and confusing, and MSPs are stretched. But demand for this exact product is unproven. I found no one asking for a $5,400 MSP-sold evidence tool. The market is small and my sizing is assumption-heavy: TAM about $270M, SAM about $81M gross, SOM about $4.1M gross. The key inputs, such as the under-50 share, MSP reach and MSP margin, have no data behind them. On July 13, 2026, DoD suspended Phase II third-party certification, and a binding class deviation later locked that in. Self-assessments, SPRS scores and annual affirmation still apply, so some demand holds. But the 'auditor-ready' pitch loses its deadline. Founder background, team and stage are unknown. This is not launch-ready. Interview 10 to 15 MSPs first.
Your idea
Target: Primary buyer: managed service providers (MSPs) that support small US defense subcontractors. End user: the subcontractor itself, with under 50 employees, holding or bidding on DoD contracts that require CMMC Level 2.
Main competitor: IntelliGRC
On July 13, 2026, the Department of War suspended CMMC Phase II, which would have required third-party Level 2 certification from November 10, 2026. Phase I self-assessments remain in force.
Your leverage points
Build on these strengths
- Reposition from 'auditor-ready' to self-assessment, SPRS accuracy and annual affirmation, which still apply while Phase II is paused. Test this wording with MSPs before building more.
- Offer a multi-client MSP view with simple onboarding for small MSPs. Reddit posts show MSPs struggling with 100+ controls across many clients, and one says a multi-tenant tool helped. Check whether IntelliGRC and Apptega leave a gap here.
- Store only hashes and links to evidence, not the files. This could keep you out of CUI scope and avoid heavy hosting costs. It is untested, so confirm it with a CMMC assessor or lawyer first.
Watch out for
- Price squeeze: Cyber Verify is reportedly $1,188 to $3,588 a year per client (unverified), and Paramify is $8,000 to $25,000. After an assumed 25% MSP margin, your net is about $4,050 per client. Find out what MSPs actually pay today.
- Liability and trust: a reviewer warns a polished SSP can make an incomplete program look finished, with False Claims Act risk. Any SPRS scoring error could land on you. Get legal advice on disclaimers and scoring logic.
- Policy risk: the DoD reform outcome is unknown, and it aims to lower burdens on small firms. Rules could get lighter, and spending could drop or move to simpler tools. Do not build a plan that needs a deadline to return.
Growth potential
My SOM is about $4.1M gross a year (assumption, 750 firms at $5,400). The SAM is about $81M gross, also an assumption. The 10% CAGR is for global Compliance as a Service, not this niche. Policy is unsettled, so growth is unknown.
Tech complexity
The app itself is manageable: control mapping, SPRS score math, file hashing, export and multi-tenant roles. The hard parts are scoring accuracy against the DoD method and, if you host evidence, possible CUI scope and FedRAMP Moderate cost. I did not cost that.
Revenue timeline
This is my estimate, not sourced. It assumes 3 to 6 months of MSP interviews and a pilot, then slow MSP onboarding. The Phase II pause may delay purchases. At $5,400 per client, 100 paying clients would be about $540,000 gross a year. That is an illustration, not a forecast.
- • Your pitch is "auditor-ready Level 2 evidence." On July 13, 2026, DoD suspended CMMC Phase II, the third-party Level 2 certification step. A later report says a binding class deviation locked the pause in. The outcome of the review is unknown. Self-assessment, SPRS scores and annual affirmation still apply. The urgency that would make small firms buy has gone for now. The brief does not mention the pause.
- • Price is squeezed from both sides. Paramify's Level 2 plans are $8,000 to $25,000 a year (per one review site that may take referral pay). One MSP-focused source lists Cyber Verify at $99 to $299 per client per month. That is $1,188 to $3,588 a year, below your $5,400. I could not verify it on the vendor's page. IntelliGRC, an MSP-focused platform, raised a $3.5M seed in Jan 2026. Apptega raised $15M in 2024 and FutureFeed has a partner program. I found no clear reason to pick you.
- • 7 criteria
- • Weakest block: Unfair Advantage. Nothing in the brief shows why you beat IntelliGRC, Paramify or cheaper MSP tools.
- • 2 strong signals
- • Reachable: $81M gross (about $60.8M net)
VC scorecard
38/100
TAM about $270M and SAM about $81M gross, both built on assumptions. Small for venture scale. SOM about $4.1M gross.
The pain is real, but the Phase II suspension removed the deadline. Self-assessment and SPRS duties remain, so urgency is lower, not gone.
Competition score is 28 of 100. IntelliGRC, Apptega, Paramify, FutureFeed and Vanta all play here. A cheaper CMMC tool already exists.
No clear moat. Features are copyable. MSP switching costs and data lock-in are unproven.
A recurring $5,400 price is clear. MSP margin is undefined, onboarding cost is unknown, and a done-with-you setup can erode margin.
The MSP channel is large (40,000 to 50,000 US MSPs per secondary sources). I found no data on how many serve defense firms. MSPs may see you as a margin squeeze.
Founder background, team, funding and product stage are not stated. The brief shows rule knowledge but no proof of delivery.
PMF signals
30/100
Reddit posts describe small-firm cost shock ($100k to $336k quotes over 2 years) and MSPs overwhelmed by 100+ controls. These are search snippets, not full threads.
One small firm asked for a tracking and readiness tool. The only reply I saw was from a vendor. I found no one asking for an MSP-sold evidence tool.
MSPs compare multi-tenant tools like Compliance Scorecard and Apptega. Paramify lists plans at $8,000 to $25,000 a year. Buying behaviour exists.
No price test. Cyber Verify is reportedly lower (unverified) and Paramify higher. MSP margin is undefined.
Phase II third-party certification is suspended. Self-assessment and affirmation still apply, and primes still ask for SPRS. Firms are reportedly split about 50/50 on moving ahead.
No evidence that MSPs would resell your tool. No MSP relationships are stated in the brief.
I found no reason a buyer would pick this over IntelliGRC, Apptega or cheaper options. Gaps are untested.
The brief states no users, pilots, revenue, team or product stage.