Evidence as a service.

The legal drivers

Three regulations and one market force converge on the same two questions.

Driver	What it requires	Status	What Guardian supplies
NIS2, Article 21(2)(c) and (d)	Business continuity including backup management and disaster recovery as an evidenced control; supply-chain security, so in-scope companies must assess their suppliers, pushing the same questions to small firms below the thresholds. Germany applied its law from 6 December 2025 with no grace period.	In force; audits under way	The backup half of the report, mapped to Article 21
Cyber-insurance underwriting	Isolated backup credentials, immutable storage and tested restores within the last 90 days with documented results; aligning with NIS2 Article 21 passes most questionnaires.	Every renewal	Quarterly attestation and the insurance pack
Cyber Resilience Act (EU 2024/2847)	From 11 September 2026 manufacturers must report actively exploited vulnerabilities within 24 hours, including for products already on the market; from 11 December 2027 full requirements apply, including security updates for a support period of at least five years.	Reporting live since September 2026	The exposure half: unsupported or end-of-life equipment becomes a documented liability, and the report names it
Swiss context	Switzerland is outside NIS2, but Swiss suppliers to EU customers receive the same supply-chain questionnaires, and Swiss cyber insurers ask the same underwriting questions. Critical-infrastructure operators in Switzerland also have a reporting duty to the federal cyber-security office.	In force	A Swiss-based provider that speaks to both sides

The event that makes the pitch

In the night of 11–12 October 2026, attackers reached Danfoss refrigeration controllers at French supermarkets, among them Intermarché and Netto stores (about 150 according to Les Mousquetaires, 300 or more according to AFP) and sites of Coopérative U and other chains; further stores were disconnected as a precaution and losses are expected in the tens of millions of euros. The vendor said the affected units were older models whose security software could not be updated against a risk it had already identified, and a security firm had flagged the weaknesses shortly before. Similar disruptions had hit US military commissaries in late August. Source: E24, BBC and Reuters reporting, 13 October 2026.

Every lesson in that story is a line in the Guardian report: know what is reachable, know what is unsupported, disconnect what cannot be fixed, and be able to prove you did.

Market

• Who: companies with 10 to 500 staff in Switzerland, Germany and Austria, and the managed-service providers (MSPs) who run their IT. First verticals: food retail and distribution, pharmacies, clinics, hotels, logistics, property management, where operational equipment sits on the network.
• How many: there are more than 3.5 million SMEs in Germany alone and roughly 600,000 in Switzerland; Veeam and Proxmox count hundreds of thousands of installations across DACH. If one in a thousand buys Guardian, that is several thousand customers.
• What they buy today: backup software and an IT provider. Neither gives independent evidence. Compliance consultants give evidence once a year for €5,000 and up. Guardian gives it monthly for €199.
• Competition: enterprise tools (Veeam ONE, security-rating services such as those used by large insurers) are priced and designed for big companies. The small-company evidence gap is open.

Business model

Product	Price	Marginal cost	Role
Company	€199 a month	About €15 (hosting, scanning, DNS and end-of-life checks, model usage)	Core subscription: backup evidence, exposure, email spoofing, expiry, equipment end-of-life
Company Plus	€299 a month	About €25 (breach-data and domain feeds)	Leaked credentials, lookalike domains, Microsoft 365 posture, website hygiene; nearly pure margin over Company
Compliance	€399 a month	About €30 plus founder review time	NIS2 policy kit and questionnaire answers generated from live evidence; replaces a €5,000-a-year consultant
Provider, 10 sites	From €449 a month	About €60–120	Scale channel: one MSP brings ten sites
Insurance pack	€690 one-off	Founder's time, about 4 hours	Entry product before renewals; converts to subscription

Scope. Every service is non-intrusive: public data and read-only connections. Guardian does not perform penetration tests or exploitation; that keeps liability, insurance and criminal-law exposure (Art. 143bis StGB in Switzerland, § 202a StGB in Germany) on the safe side and keeps every check automated.

Milestones. €1,000 a month is five Company customers or two Providers and one Company. Thirty Company customers and ten Providers is about €125,000 a year at roughly 85% gross margin, run in home-office hours with Claude generating the reports.

Channels, in order of expected return: the founder's professional network and LinkedIn; Swiss and German MSP communities, where one partner multiplies sites; insurance brokers, who want clients to pass underwriting; and content, starting with a plain-language explainer on the French freezer attack in German, French and English.

Built with AI, deliberately. Claude Code builds the collectors and scanners; Claude writes every report from structured findings, in the customer's language; the founder reviews and signs attestations. This is why the price can be a tenth of a consultant's.

Cost to launch

Item	What it covers	Lean (€)	Full (€)
Infrastructure	Server, scanning nodes, backups, monitoring, domain	900	2,400
Legal	Company registration or sole-trader setup, terms, authorised-scanning agreement, data-processing agreement, employer side-business clearance	1,500	4,000
Insurance	Professional liability covering security services	800	1,500
Brand and site	Logo, this site, sample report design	300	1,500
Marketing	Content, two trade-group memberships, first broker meetings	500	2,500
Software and data	Vulnerability data feeds, email, invoicing, model usage	600	1,500
Total		4,600	13,400

Founder time excluded. No inventory, no production, no trading capital: the cheapest idea on the hub to test.

Timeline

When	Milestone
October 2026	Employer clearance confirmed; legal terms drafted; collector for Veeam and external scanner built with Claude Code; sample report produced from the founder's own lab
November 2026	Two pilot customers from the founder's network at no charge for one month; report format fixed on their feedback
December 2026	Pilots convert to paid; freezer-attack explainer published; first broker conversation
Q1 2027	Proxmox, Synology and Azure Backup collectors; first MSP partner; target five paying customers (€1,000 a month)
Q2 2027	Insurance pack launched before mid-year renewals; target €3,000 a month
H2 2027	Cyber Resilience Act full application approaches; "unsupported equipment" report module marketed to facility managers; target €8,000 a month

Chance of success

Scored the same way as every idea on the hub: seven factors, 0 to 10, where success means a business that pays its people and still exists in three years. Overall: 6 / 10, the highest on the hub.

Factor	Score	Why
Market need	8	Law, insurers and customers all demand the same evidence; the freezer attack made it visible to non-technical owners.
Differentiation	6	Independent evidence for small companies at a tenth of consultant prices; enterprise tools do not serve this segment. Copyable by an MSP, but few will.
Founder fit	8	Backup, monitoring, security and automation are the founder's daily work; police and central-bank background gives credibility in a trust business.
Key dependency	5	Selling, not building: the first five customers must come from the founder's own network and a broker or MSP partner.
Regulatory path	7	Authorised scanning and liability are well understood; employer side-business rules are the one gate to clear first.
Unit economics	8	About 85% gross margin, no inventory, monthly recurring revenue.
Capital and time	5	Under €5,000 to start, but weekends and evenings beside a full-time job and other projects.

What would raise it substantially

• Two paying pilot customers from the founder's network (+2).
• One insurance broker or cyber insurer who recommends the report to clients (+1).
• One MSP partner bringing ten sites on the Provider plan (+1).
• Written employer clearance for the side business, removing the main personal risk (+1 on capital and time).

The rule that follows: spend under €5,000 and two months to get two pilots live. If both convert to paid, build the rest. If neither does, the evidence says the market wants it but not from a part-time founder, and the loss is small.

Risks

Risk	Answer
Employer rules on side businesses	Ask in writing before the first sale; structure as a company if required
A scan touches something unauthorised	Written scope per customer, scanning only listed addresses, logs kept; liability insurance
A customer suffers an attack anyway	Guardian reports and attests; contracts state it does not operate the backups or firewall
MSPs see Guardian as a competitor	Position as their evidence layer, white-labelled; the Provider plan makes them the seller
Vulnerability data quality	Use established feeds, show sources in the report, mark uncertain findings as such