Launch plan, 13 October 2026
From idea to €1,000 a month in 90 days.
Beside a full-time job, with under €5,000 and no more than ten hours a week. Everything below is sequenced so that no money is spent before the gate is cleared, and no building happens that a pilot customer has not asked for.
5paying customers by 13 January 2027
€1,000monthly recurring revenue at that point
< €5,000total spend to get there
10 hper week of founder time, maximum
Superseded in part, 14 October 2026. An independent review narrowed the product to restore evidence, moved IT providers to first channel, fixed the pricing and replaced the calendar and money table. The gate, set-up and roles below still apply. Read the review and plan v2.
The gate: employer clearance
One thing comes before everything. Ask HR or compliance this week, in writing, for permission to run a side business: a non-intrusive monitoring and reporting service for small companies, with no overlap with the bank's suppliers or clients, no use of bank systems, time or information, and no security work that could be read as testing or attacking. Until the written answer is in, build only in your own lab and sell nothing.
The pitch in one sentence, for every conversation from here on: "Guardian proves every month that your backups would restore and that nothing of yours is exposed on the internet, in a report your insurer and your auditor accept."
Step 1 — Setup, weeks 1–2
| Item | Decision | Cost (€) |
|---|---|---|
| Legal form | Start as a Swiss sole proprietorship (Einzelfirma) for speed; convert to a GmbH once revenue passes €3,000 a month or a customer requires it. Register with the commercial register if turnover will exceed CHF 100,000; otherwise optional at first. | 0–600 |
| Terms of service | Have a lawyer review a short contract covering: scope limited to listed assets, written authorisation for every scan, no penetration testing, reporting-only liability, data processing under Swiss DPA and GDPR, Swiss law and venue. | 1,200–1,800 |
| Authorisation form | A one-page "Scope and authorisation" the customer signs per site: public IP ranges, domains, backup system, device list, named contact. Nothing is checked that is not on this page. | In the legal fee |
| Insurance | Professional liability for IT services covering monitoring and reporting. Ask the broker explicitly to confirm "no penetration testing" is in the wording. | 800–1,200 a year |
| Bank and invoicing | A separate business account; invoicing through a simple tool with Swiss QR-bill support. | 0–20 a month |
| Brand | The site already exists. Register the domain, set up hello@ and a signature. No logo contest, no agency. | 30–80 |
Step 2 — Build, weeks 1–6
Claude Code builds everything; you review, test in your own lab and sign. Build in this order, and stop at each step to show it to a pilot customer before moving to the next.
| Order | Component | How | Done when |
|---|---|---|---|
| 1 | Backup collector, Veeam first | Read-only account on the Veeam REST API; nightly pull of job results, repository immutability, retention, SureBackup or restore-test records into Postgres on a Hetzner server. | Your own lab produces a correct daily dataset for seven days. |
| 2 | Exposure collector | Scheduled scan of authorised ranges with nmap and httpx; fingerprinting; match against the NVD and CISA known-exploited list; vendor end-of-life matching from the customer's device list; SPF, DKIM, DMARC and certificate checks from public DNS. | Your own public IPs scanned monthly with no false alarms you cannot explain. |
| 3 | Report generator | Findings go to Claude with a fixed template: seven questions, traffic lights, fix list in priority order, written for a managing director in German or English. You read every report before it ships. | A pilot customer reads it without asking what anything means. |
| 4 | Alerts | Same-day email when a backup job fails twice, a new service appears on the internet, or a listed device goes end-of-life. | An alert fires in the lab within one hour of the event. |
| 5 | Attestation | A quarterly PDF with the restore-test history and exposure status, signed by you, formatted to answer the common insurer questions line by line. | A broker says it would satisfy a questionnaire. |
| 6 | Plus checks | Breach-data lookups for the customer's email domain, lookalike-domain monitoring, Microsoft 365 posture through a read-only Graph app, website hygiene. | Only after the first three paying customers. |
| 7 | Other backup systems | Proxmox Backup Server, Synology, Azure Backup collectors. | When a prospect asks; not before. |
Stack: Python, Postgres, one Hetzner server in Helsinki or Nuremberg, systemd timers, Claude API for report writing, a static status page. No Kubernetes, no SaaS platform, nothing you have not run before. Everything already matches what you operate at work and on your own servers.
What you never build: a customer dashboard before month four, a mobile app, a billing platform, integrations nobody has asked for.
Step 3 — Two pilot customers, weeks 3–8
Pilots are how the report format gets fixed. Two is enough; they must be real companies with real backups, and they should be different from each other: one running Veeam directly, one through an IT provider.
- Who to ask: former colleagues from Norway, Austria or Switzerland who now run or manage IT at a company with 20 to 200 staff; a friend's company; the IT provider of a business you already know. Ask three, expect two.
- The deal: free for the first month, then €199 a month or a frank reason why not. Written scope and authorisation signed before the first scan, even for friends.
- What they get: the first report by hand, walked through on a call, and the question "what would you change?" Their answers become the template.
- What you get: two named references, two quotes for the site, and the first evidence that the report answers a real insurer or auditor question.
Step 4 — Selling, from week 8
Selling is the key dependency in the score, so it gets a method, not hope. Targets: five paying by day 90, fifteen by day 180, thirty by day 365.
Channels, in order
- Your own network, directly. Thirty personal messages to people you know who run or influence IT at small companies. Expect one in six to take a call and one in three calls to convert. That is the first five customers.
- IT providers (MSPs). The multiplier: one provider brings ten sites. Find twenty in Zürich, Aargau, Basel and Bern; offer the Provider plan with their name on the reports. Pitch: "your customers' insurers ask for evidence you cannot easily produce; we produce it under your brand."
- Insurance brokers. Five brokers who place cyber cover for SMEs. They lose deals when clients cannot answer the questionnaire. Offer the Compliance tier as the thing that gets their client insured.
- Content. One plain-language article a month, in German and English, starting with the October 2026 freezer attack: what happened, what it means for a shop or a clinic, five things to check this week. Posted on LinkedIn and the site; no paid ads before month six.
The call, in ten minutes
- Ask what their backup system is and when they last restored something on purpose. Most cannot answer the second question.
- Ask whether their insurer or a customer has sent a security questionnaire in the last year. Most say yes.
- Show one page of a sample report with the two red rows: restore test older than 90 days, one device reachable from the internet.
- Offer the Company plan, first month free if they sign the authorisation this week.
Objections and answers
| They say | You say |
|---|---|
| "Our IT provider handles this." | "They operate it. We prove it works. Your insurer wants the proof, and your provider can be the one who sends it: ask them to use our Provider plan." |
| "We are too small for NIS2." | "Your largest customer probably is not, and their questionnaire lands on your desk. The report answers it in one attachment." |
| "Is this a security scan? We do not want anything broken." | "Non-intrusive only: public data and read-only connections. We never log in, never test, never change anything. It is in the contract." |
| "€199 is a lot for a report." | "A consultant's annual evidence costs €5,000 and is out of date the next day. This is monthly, and it is what your renewal depends on." |
Operations — under two hours per customer per month
- Onboarding, 90 minutes once: signed scope, read-only account created by the customer, device list received, first scan reviewed by hand, welcome call.
- Monthly, 45 minutes: read the generated report, correct anything Claude got wrong, send it on the first working day of the month.
- Alerts, as they come: a same-day email; you never fix anything yourself, you tell them what to fix and who should do it.
- Quarterly, 30 minutes: sign the attestation.
- Support: email only, answered within one working day, from a dedicated address, never from your work phone.
At thirty customers that is roughly 25 hours a month, inside the ten-hour-a-week limit. Beyond forty, hire a part-time analyst or stop adding Company customers and grow only through Providers.
Money
| Month | Customers (Company / Plus / Compliance / Provider) | MRR (€) | Costs (€) | Cumulative cash (€) |
|---|---|---|---|---|
| Oct 2026 | 0 (setup, build) | 0 | 2,800 | −2,800 |
| Nov | 2 pilots, free | 0 | 400 | −3,200 |
| Dec | 2 / 0 / 0 / 0 | 400 | 400 | −3,200 |
| Jan 2027 | 4 / 1 / 0 / 0 | 1,100 | 450 | −2,550 |
| Feb | 5 / 2 / 0 / 1 | 2,050 | 500 | −1,000 |
| Mar | 6 / 3 / 1 / 1 | 2,900 | 550 | 1,350 |
| Apr | 7 / 4 / 2 / 2 | 4,200 | 650 | 4,900 |
| May | 8 / 5 / 3 / 2 | 5,200 | 700 | 9,400 |
| Jun | 9 / 6 / 4 / 3 | 6,500 | 800 | 15,100 |
| Jul | 10 / 7 / 5 / 3 | 7,400 | 850 | 21,650 |
| Aug | 11 / 8 / 5 / 4 | 8,300 | 900 | 29,050 |
| Sep 2027 | 12 / 9 / 6 / 4 | 9,300 | 950 | 37,400 |
Assumptions: Company €199, Plus €299, Compliance €399, Provider €449 average. Costs are hosting, feeds, model usage, insurance, tools and a modest content budget; founder time excluded. Break-even on cash in March 2027 if the sales targets hold; three months later if they slip by half. Taxes and social contributions on profit are not included.
The first 90 days, week by week
| Week | Actions | Output |
|---|---|---|
| 1 · 13–19 Oct | Employer clearance request sent. Hetzner server up. Veeam read-only account in your lab. Claude Code brief for the backup collector. | Request in writing; collector pulling lab data. |
| 2 · 20–26 Oct | Lawyer briefed on terms and authorisation form. Broker asked for liability quotes. Exposure collector started. | Quotes in; first scan of your own ranges. |
| 3 · 27 Oct–2 Nov | Report template with Claude; first full lab report. Three pilot invitations sent. | One readable report; two pilots agreed. |
| 4 · 3–9 Nov | Terms signed off. Insurance bound. Pilot 1 scope signed and connected. | Legal and insurance done; first real data. |
| 5 · 10–16 Nov | Pilot 2 connected. Alerts built. First freezer-attack article drafted in German and English. | Both pilots live; article ready. |
| 6 · 17–23 Nov | First pilot reports delivered by hand and walked through. Template corrected from feedback. | Two reviewed reports; two quotes requested. |
| 7 · 24–30 Nov | Article published. Attestation format drafted and shown to a broker. | Broker feedback; first inbound contact. |
| 8 · 1–7 Dec | December reports sent. Pilots asked to convert. Thirty personal messages sent. | Two paying customers; first calls booked. |
| 9 · 8–14 Dec | Sales calls. Twenty MSPs listed; five contacted. | Three to five calls held. |
| 10 · 15–21 Dec | Close what is ready before the holidays. Second article drafted. | Three paying. |
| 11 · 22 Dec–4 Jan | Quiet weeks: January reports prepared, Plus checks built. | Plus tier ready to sell. |
| 12–13 · 5–13 Jan | January reports sent. Remaining calls from the thirty messages. First MSP proposal. | Five paying, €1,000 a month. |
Kill criteria and risks
Decide in advance what would stop the project, so the decision is not made in a tired moment.
- Stop if the employer says no in writing: Guardian waits, or is sold to a partner who runs it.
- Stop if neither pilot converts to paid by 15 December and cannot say what would have changed their mind.
- Stop if fewer than three customers pay by 31 January 2027 after all thirty messages and ten calls.
- Stop if monthly delivery takes more than two hours per customer by month four; the model is not working.
| Risk | Answer |
|---|---|
| Employer rules | Written clearance first; GmbH with a separate address if required. |
| Scanning something unauthorised | Only addresses on the signed form, logged; a quarterly review of every scope. |
| A customer is attacked anyway | Contract states Guardian reports and attests, never operates; the report trail shows what was flagged and when. |
| MSPs see competition | Provider plan with their name on the report; you never contact their clients directly. |
| False findings | Every report read by you before sending; sources shown; uncertain findings marked as such. |
| Founder time | Ten-hour weekly cap; growth beyond forty customers only through Providers or a part-time analyst. |
Launch checklist
- Employer clearance requested in writing
- Employer clearance received
- Hetzner server and lab Veeam connected
- Backup collector producing daily data
- Exposure collector scanning own ranges
- Report template approved by a non-technical reader
- Terms and authorisation form reviewed by a lawyer
- Liability insurance bound, "no penetration testing" confirmed
- Business account and invoicing live
- Pilot 1 scope signed and connected
- Pilot 2 scope signed and connected
- First two reports delivered and reviewed
- Freezer-attack article published
- Attestation format checked by a broker
- Thirty personal messages sent
- Twenty MSPs listed, five contacted
- Two pilots converted to paid
- Five paying customers