Business Path · LA · AUDIT_ASSESSMENT
AI-code provenance posture assessment
Opportunity: AI-code provenance attestation (CI/procurement gate) · Pays: CISO
The opportunity
Security/DevOps cannot prove human-vs-agent authorship for compliance (CRA, FedRAMP, SSDF).
Target customer: mid-market security teams · Why now: SLSA Source Track v1.2; CRA fines up to 2.5% global sales
Business model
Commercial: assessment + report · Revenue: project fee · Pricing: $3k-$10k per assessment · Automation: SEMI_AUTOMATED
Minimum launch version
manual service — software is not required first.
Step-by-step: {"day_1": "buyer interviews", "days_2_3": "build MVP deliverable", "days_4_7": "land first pilot", "week_2": "first paid engagement", "weeks_3_4": "standardize", "month_2": "3+ customers", "month_3": "automate"}
Financial scenarios (illustrative)
Financial scenarios and full pathway economics are in the report. Public pages keep the pathway framing, not the numbers. Read the report — free during Open Access.
Risks / Substitutes / Falsifiers
Main risks: JFrog absorbs
Substitutes: JFrog AppTrust, GitHub, manual/consultancy
Falsifiers: security says 'JFrog covers this'
Moat / asset flywheel
AI-code provenance/posture corpus + benchmark — each assessment adds posture benchmark data