Independent review and plan v2, 14 October 2026
Workable. Narrow it to restore evidence and sell through IT providers.
The demand is real and dated, the founder fits the problem, and testing it costs little. As written, the plan is too broad and leads with its weakest half. This page replaces the launch plan's product, pricing, calendar and numbers. The gate, the legal set-up and the roles stay the same.
Verdict
Not nonsense. NIS2 Article 21(2)(c) makes backup management and disaster recovery an evidenced control. The Cyber Resilience Act's reporting duty has applied since 11 September 2026. Insurers' and large customers' questionnaires ask for recovery evidence. A founder who runs backups and servers for a living can build the collector cheaply.
But the external-exposure half is already free. Insurers give it away: Coalition Control is free even to non-policyholders, At-Bay includes scans with its policies, and Chubb gives policyholders BitSight and SecurityScorecard reports. A small company won't pay €199 a month for something its broker offers for nothing. Nobody cheaply checks and records that a restore was tested and worked, that an immutable copy exists, and that backup credentials are separate. That is the product.
What changes from the 13 October plan
| Topic | 13 October plan | Plan v2, and why |
|---|---|---|
| Lead offer | Backups plus external exposure, monthly | Restore evidence first. Exposure checks (DNS, certificates, device end-of-life) are included quietly and never headlined, because insurers offer them free. |
| Collection | "No agents": a remote read-only pull | A small collector with outbound HTTPS only, at the customer or the IT provider. Veeam's REST API (port 9419) sits on the backup server inside the network, so a remote pull can't reach it. It sends summaries only, never backup data or central credentials. |
| Restore tests | Read SureBackup records | A guided restore-test kit: a runbook for a file, a VM and a mailbox, plus an evidence form, hash and timestamp script, and log extracts. SureBackup needs Veeam's Universal licence, so Community and Standard users restore by hand. That gap is the business. |
| Channel | Own network first, MSPs second, brokers third | IT providers (MSPs) first. They already hold the credentials and do the restores; Guardian checks and records them under the provider's name. One partner brings 5 to 10 sites. Only about 1 in 10 Swiss SMEs has cyber insurance, so the Swiss demand comes mainly through suppliers' questionnaires and MSPs. |
| Pricing | Provider €449 for 10 sites (€45 a site) against Company €199 | Priced per site, so a direct customer isn't undercut by its own IT provider (below). |
| Wording | "Attestation", restore test "within 90 days" | "Evidence report, signed by the verifier", not an audit opinion. Insurers ask for recovery tests "yearly to quarterly, depending on the insurer". The 90-day figure came from a US vendor blog. Aon Switzerland's SME questionnaire asks for at least yearly. |
| Postponed | Compliance tier, AI-written NIS2 policy kit, Plus checks, scanning customer ranges | The policy kit invites liability. Plus checks wait until three customers pay. No port scanning of customer ranges for six months. |
| The French attack | "Monday 12 October, about 180 Intermarché stores" | The night of 11–12 October 2026. Store counts vary by source: Les Mousquetaires said about 150, AFP 300 or more Intermarché and Netto stores. Quote a range. The affected Danfoss controllers were "legacy" units that no longer get updates. |
Product v2
Restore Check
- Guided restore test with the customer or its IT provider
- Evidence record: hashes, timestamps, log extracts, screenshots
- Short report for the insurer or a customer questionnaire
- The entry product, and the way into a subscription
Evidence
- Collector on the backup server, outbound only
- Monthly evidence: jobs, retention, immutability, credential separation, MFA on the console
- Quarterly guided restore test, verified and recorded
- Questionnaire answers from the evidence; DNS, certificate and end-of-life checks included
Partner
- Reports in the IT provider's name
- The provider performs the restores; Guardian verifies and records them
- One Veeam Service Provider Console connection covers all its clients
- Guardian never contacts the provider's clients directly
The next 12 weeks, from Monday 19 October
G = Gudmundur, K = Katherina, C = Claude as project manager. Katherina never holds credentials, touches a customer system or signs anything.
| Week | Dates | Action | Owner | Output |
|---|---|---|---|---|
| 1 | 19–25 Oct | Employer clearance request sent: the gate. Hetzner server, lab Veeam, read-only account. Collector brief. | G, C | Request on file; collector spec |
| 2 | 26 Oct–1 Nov | Collector v1 in the lab: a container, outbound HTTPS only, JSON summaries, no backup data. Lawyer and two brokers briefed. | K, G, C | 7 days of lab data; quotes |
| 3 | 2–8 Nov | Restore-test evidence kit v1: runbook (file, VM, mailbox), evidence form, hash and timestamp script, checklist. Dry run in the lab. | C, K, G | Kit; first lab record |
| 4 | 9–15 Nov | Report v1 from lab data, tested on a non-technical reader. Invitations to 3 companies and 3 MSPs. Gate: no clearance, no pilots. | G, K | Draft report; replies |
| 5 | 16–22 Nov | Terms, scope form and insurance signed. Pilot A (direct Veeam) onboarded. | G | Signed documents; real data |
| 6 | 23–29 Nov | Pilot B (through an MSP) onboarded. Article on the 11–12 October attack, in German and English. | G, K | Both pilots live; article |
| 7 | 30 Nov–6 Dec | Guided restore test at Pilot A; evidence verified. | G, K | First real restore record |
| 8 | 7–13 Dec | Restore test at Pilot B. Both reports delivered by hand. A broker reads one. | G, K | Two reports; broker feedback |
| 9 | 14–20 Dec | Fix the kit and the report. Ask both pilots to convert. 20 personal and 10 MSP messages. | G, K, C | Conversions; calls booked |
| 10 | 21–27 Dec | Invoicing live, collector hardened, MSP pitch deck. | K, C | Tooling done |
| 11 | 28 Dec–3 Jan | January reports prepared. Restore Check offered to 5 warm contacts. | G | Offers out |
| 12 | 4–10 Jan 2027 | Sales calls; milestone review against the kill criteria. | G, C | Decision memo |
Kill criteria and the three biggest risks
- 30 November: no written employer clearance → sell nothing; by 31 January decide whether a partner holds the company.
- 13 December: fewer than 2 pilots with a completed restore test → stop.
- 31 January 2027: fewer than 2 paying customers → stop.
- 31 March 2027: under €1,000 MRR, or more than 2 hours per customer per month → stop or hand it to an MSP.
- Any time: a complaint about unauthorised access or data → stop at once.
| Risk | Answer |
|---|---|
| Selling beside a full-time job | MSPs first: one partner is 5 to 10 sites. Gudmundur does only the 10-minute calls; Katherina books them. |
| Guardian becomes a target, or is blamed when a customer is attacked anyway | Summaries only, no central credentials; the contract says "evidence report, not an audit opinion"; professional liability insurance. |
| MSPs see a competitor | They do the restore and keep the client, and the report carries their name. |
Realistic numbers
The 13 October money table (break-even in March 2027) is about twice this base case. Use these figures instead.
| Month 3 (Jan 2027) | Month 6 (Apr 2027) | Month 12 (Oct 2027) | |
|---|---|---|---|
| Conservative | 2 direct · €360 MRR | 4 direct + 1 MSP (5 sites) · €1,100 | 8 direct + 2 MSPs (15 sites) · €2,600 |
| Base | 3 direct + 1 MSP (5 sites) · €930 | 7 direct + 2 MSPs (15 sites) · €2,400 | 15 direct + 4 MSPs (40 sites) · €5,900 + about €3,000 one-off Restore Checks |
Cash need: €7,500 in total (legal €2,000, insurance €1,200, server and tools €600, lab and model usage €700, contingency €3,000), of which under €5,000 is spent before the 31 January decision. Founder time excluded. Cash break-even around month 6 in the base case, month 9 in the conservative case.
Sources checked on 14 October 2026: BleepingComputer, Infosecurity Magazine and AFP reporting on the French attack; Coalition (free Control tier); Veeam Help Center (REST API port, recovery verification licensing); Aon Switzerland (SME questionnaire); Deloitte Switzerland cyber study 2026 (insurance uptake); CMS and McCann FitzGerald on Cyber Resilience Act dates.