Nineteen ideas. One honest method.

Guardian — backup evidence and exposure evidence, monthly

Every company runs backups and has a firewall; almost none can prove the backups would restore after ransomware, or knows what of its equipment is reachable from the internet. Guardian connects read-only to the backup system, scans the customer's authorised addresses against known-vulnerable and end-of-life equipment, and Claude writes a plain-language monthly report plus a quarterly attestation. It is the evidence NIS2 auditors, cyber insurers and customers' supply-chain reviews now demand.

Product siteBusiness planLaunch planProject officeReview and plan v2 (3/10, MSP-first)

Why now

• NIS2 names backup management as an evidenced control, and supply-chain clauses push the questions to small suppliers.
• Insurers check tested restores within 90 days and immutable copies at renewal.
• The Cyber Resilience Act made vulnerability reporting mandatory from 11 September 2026 and brings minimum five-year security-update periods from December 2027; unsupported equipment becomes a documented liability.
• 12 October 2026: attackers reached refrigeration controllers at about 180 Intermarché stores and other French chains through remote-management software that could no longer be updated; losses in the tens of millions of euros. The exposure report exists to catch exactly that.

Offer

• Company, €199 a month: backup evidence, non-intrusive exposure check, email spoofing protection (SPF, DKIM, DMARC), certificate and domain expiry, equipment end-of-life watch, monthly report, alerts, quarterly attestation.
• Company Plus, €299 a month: adds leaked staff credentials, lookalike-domain watch, Microsoft 365 posture (read-only) and website hygiene.
• Compliance, €399 a month: adds a NIS2 Article 21 policy kit and questionnaire answers generated from live evidence.
• Provider, from €449 a month: IT providers, up to ten client sites, reports in their name.
• No penetration testing. Public data and read-only connections only; Guardian observes and proves, it never attacks.

€1,000 a month is five Company customers. Thirty companies and ten providers is about €125,000 a year at roughly 85% gross margin. Clear employer side-business rules before the first sale.

Passport — digital product passports for small brands

The EU will require a scannable Digital Product Passport on textiles and then on most physical products. Enterprise tools cost thousands a month; a maker with 200 products a year cannot buy them. Passport is a €39-a-month service: upload a photo and answer a few questions, and Claude drafts the material, origin, care and repair data in the EU's structure, generates a QR or NFC page per product, and keeps the record for the product's life. It is the same tool ÞEL needs for its provenance tag.

Why now

• The EU passport registry went live on 20 July 2026; the textile act is due in late 2027, with obligations around 2028–29.
• Early adopters sell on the story before it is mandatory; ÞEL is customer number one.
• The data model is published, so the product can be built before the act lands and adjusted when it does.

Offer and price

• Maker, €39 a month: up to 300 products, QR pages, NFC export.
• Brand, €149 a month: 3,000 products, batch import, custom domain.
• Setup, €290: Claude-assisted data migration from a spreadsheet.

€1,000 a month is about 25 makers, which takes longer to find than seven MSPs: a slower, bigger idea.

Lopapeysa — verified authentic Icelandic sweater resale

Buy hand-knit Icelandic sweaters from Icelandic knitters, estates and second-hand sources, verify each against the protected-origin criteria, photograph and describe it with Claude in four languages, and sell to the US, Japan and Europe on an own shop plus eBay and Etsy. The simplest buy-and-sell idea here, and the one the law most clearly favours.

Why now

• Since 2020 only sweaters hand-knit in Iceland from Icelandic wool with a seamless circular yoke may be called lopapeysa; about two thirds of those sold to tourists are imports.
• Buyers abroad cannot tell the difference; a verified-authentic seller can.
• When textile passports arrive, a passport per sweater is the natural upgrade, and Passport provides it.

Offer and price

• Authentic pre-owned, €140–220, with a verification note and the knitter's region where known.
• New, commissioned from Icelandic knitters, €260–340, made to order in natural colours.
• Vintage and rare patterns, €300 and up.

Margins of €40–70 per pre-owned sweater; 20 a month is €1,000. Needs hands, storage and a sourcing contact in Iceland.

ÞEL — a luxury label built on Icelandic materials

Fine inner-coat wool, salmon leather and an earth-dyed cloth nobody else makes, sold first to the two million visitors passing through Reykjavík, then online to the US and Europe. Own the material, not just the label.

Brand siteBusiness planNine ideas inside ÞEL, scored

• Lifetime repair and buy-back 7/10 · €3–5k
• Þel-lined salmon glove 6/10 · €8–12k
• Sell in Iceland first 6/10 · €25k pop-up
• Fine þel knitwear 5/10 · €35–50k
• Provenance passport 5/10 · €8–15k
• Earth-dyed cloth, licensed 4/10 · €25–40k
• Arctic sneaker 4/10 · €40–60k
• Nest-to-vest eiderdown 4/10 · €20–25k
• Arctic gold: þel and muga 3/10 · €8–12k

KAT — an autonomous futures and options trading bot

A Python bot on a hardened server that scans eight futures markets and options chains, takes day and swing positions through Interactive Brokers, and is meant to learn from its own wins and losses. Built and improved with Claude Code; currently trading a paper account. The business case is first wealth-building with own capital, and only later a signal or analysis service for other traders.

Dashboard

KAT Trading Universe — the most valuable place to start trading

WebsiteProject plan and task boardPlatform

Someone starting to trade meets a wall: stocks, options, futures, margin, ticks, stops, a thousand strategies and a thousand loud people selling certainty. The Traveling Trader shows the demand: about 25,000 members, about 300,000 YouTube subscribers, a Discord since 2017, $49–129 a month, no audited record. His members pay for a daily companion, a community and alerts that feel like an edge. KAT Trading Universe offers what no single personality can: an honest, data-backed answer to any trading question, at any hour, a guided path through every market, simulators that behave like the real thing, and a disciplined engine that explains every decision, including the trades it refused and the tests that failed.

Learn from the Traveling Trader, then go further

The seven pillars

• 1. Ask KAT. Type any idea ("buy the pullback just before the 30-minute close", "is the CPI move a sure bet?", "should I add to winners?") and get a plain answer from 15 years of minute data: does it work, how often, after costs, and why. Built from the tests KAT already runs; on 14 October five such questions were answered in minutes each.
• 2. Why did the engine do that? Every engine decision explained live: what it saw, which rule allowed or blocked it, what happened next. Beginners learn by watching a disciplined process think.
• 3. Learning paths for stocks, options and futures. Short lessons, each ending in a simulator task, from "what is a tick" to building and testing a first strategy.
• 4. Simulators that behave like the real thing: real contracts and prices, realistic fills, server-side stops, with a coach after every trade.
• 5. Training wheels. The risk rules KAT learned the hard way, built into every account: daily loss limit, one trade at a time at the open, a profit lock that switches to careful mode, a cost check before every trade.
• 6. The library of what does not work. Every failed test as a two-minute lesson with its data: chasing CPI moves, adding to winners, wider stops, trend-day rules.
• 7. A track record, and signals only when earned. Every engine's forward results after costs, published with its failures. Signals are shown only for an engine that has passed its 12-month gate, with its full record beside every call, and only if they demonstrably help people.

Project plan, November 2026 – October 2027 (nothing offered for sale)

• Phase 1 · Nov–Dec 2026 · The honest core. Ask KAT v1 for Gudmundur and Matt; the engine decision explainer; the Track Record page and the failure library; success gates written with Matt and dated.
• Phase 2 · Jan–Mar 2027 · Learning paths and simulators. Futures path first (the engine's home), then options and stocks; simulator class mode with student accounts, lesson tasks, a trade journal and the coach; training-wheel accounts. First cohort: Katherina and up to ten students, tested before and after.
• Phase 3 · Apr–Jun 2027 · The daily companion. Plain-language morning brief and evening review for learners; daily simulator challenges; Matt's weekly live review; cohort community; a strategy lab where learners test their own ideas through Ask KAT.
• Phase 4 · Jul–Sep 2027 · Prove it. Second cohort, 20+ learners in total; outcomes measured; engines run forward under frozen rules; a public page with the track record, the failures and a waiting list, no prices.
• Decision · Oct 2027. Gates passed and learners demonstrably helped: design the offer, with a free tier that stays free and a fair price (around €25 a month). Gates failed: it stays our own tool, and the failure is published like every other test.

Success gates before anything is offered

• Teaching: 20+ learners finish a path; test scores rise; simulator discipline improves (stops on every trade, size within limits, fewer rule breaks); 60 % still active after three months; half say they would pay €20–30 a month.
• Each trading engine shown with results: 12+ months forward on paper with real fills (300+ intraday trades or 250 trading days), then 6+ months live at the smallest size; positive after costs, t ≥ 2, ahead of a pre-set benchmark; drawdown within twice the expectation; independently checked. Any rule change restarts that engine's clock.
• Today: no engine is near its gate (intraday futures lose about $3.60 a signal after costs). The teaching gate can pass first.

Never

• Profit or income promises.
• Calls from an engine without a proven record, or trading other people's accounts.
• Hiding a failed test.
• Redistributing licensed market data without the vendor's permission. Rules follow the customer's country, wherever the company is registered; this is settled before any offer.

AFL — Icelandic strength nutrition

Iceland has produced more World's Strongest Man winners per head than any country, and the whole world knows it. AFL is a strength and recovery line built on what Icelanders ate and did to be strong for a thousand years: skyr, fish, seaweed, moss, cold water and lifting stones. The strongmen are the proof; the land is the product.

The product universe

Six families, about thirty products. Launch with three (marked ★), add the rest as each family proves demand. Every product has a real Icelandic ingredient, tradition or place behind it.

1. Protein and food

• Skyr protein powder ★ — vanilla, bilberry and plain; Icelandic grass-fed whey blended with skyr cultures.
• Harðfiskur protein snack — wind-dried cod, the original Icelandic strongman food at about 80% protein; sold in sports portions.
• Cod protein and marine collagen — from Icelandic cod skin, zero-waste; powder and capsules.
• Skyr protein bars — with bilberry, oats and Icelandic sea salt.
• Free-range lamb jerky — Icelandic mountain lamb, nothing added but salt.
• Söl (dulse) seaweed chips — the salty snack Icelanders have eaten since settlement; iron, iodine and umami.
• Rúgbrauð carb bread — geothermally baked rye bread as the pre-training carb; sold frozen or as a bake-at-home mix.

2. Performance supplements

• Electrolytes ★ — hand-harvested geothermal sea salt plus Icelandic kelp minerals.
• Burnirót pre-workout — Rhodiola rosea, the golden root that grows wild in Iceland and was used by Vikings for stamina; with beet and bilberry.
• Omega-3 — Icelandic cod liver oil, the recovery staple every Icelandic child grew up on.
• Seaweed magnesium — marine magnesium for sleep and cramps.
• Angelica and bilberry capsules — the Viking-era medicinal plant, from an Icelandic extractor.
• Crowberry and bilberry gummies — Icelandic berries for antioxidants; the family-friendly entry product.

3. Recovery and the cold ritual

• Icelandic moss recovery drink ★ — fjallagrös with honey and birch, the warm drink after the ice bath. Sold as tradition and ritual, no health claims.
• Geothermal bath salts — mineral and silica salts for the hot-soak half of the hot-cold ritual.
• Birch and moss muscle balm — Icelandic birch bark and moss in a warming rub.
• Herbal teas — birch leaf, yarrow, angelica and moss blends.
• Hot-cold ritual kit — timer, salts, moss drink and a þel wool towel in one box; the gift product.

4. Equipment

• The Dritvík stones — cast replicas of the four lifting stones at Djúpalónssandur that fishermen had to lift to qualify for a boat, at the original weights: Amlóði 23 kg, Hálfdrættingur 54 kg, Hálfsterkur 100 kg, Fullsterkur 154 kg.
• Húsafell stone — a replica of Iceland's most famous carry stone, about 186 kg, with its history.
• Basalt-finish kettlebells and sandbags — cast iron finished like Icelandic lava rock.
• Stone-lifting programme — a graded training plan from Amlóði to Fullsterkur, online, with a certificate when a filmed lift is verified.

5. Apparel, shared with ÞEL

• Þel wool training knits and hoodies — the lopapeysa cut, made for lifting and for the walk from sauna to sea.
• Salmon-leather lifting belt and wrist wraps — strong, thin, unmistakable; made from ÞEL's skins.
• Cold-plunge robe and towel — in þel wool.

6. Experiences and content

• Strongman camp in Iceland — four days: stone lifting on the beach, sea plunge, hot spring, Icelandic food; the highest-margin product in the line and the content engine for everything else.
• Strongman history series — short films on Jón Páll's era, the stones and the fishermen, licensed carefully.
• App — programmes, the stone ladder, cold-exposure log and reorders.

Manufacturing

No factory: a licensed EU contract manufacturer (GMP and HACCP certified) formulates, blends, lab-tests and fills under the AFL brand, the same route Grace uses. Minimum orders run from hundreds to a few thousand units per flavour. The Icelandic claim rests on Icelandic grass-fed whey or skyr powder from an Icelandic dairy, shipped to the EU blender; ask every supplier for batch traceability back to the dairy. If Icelandic whey volumes are too small, the honest fallback is skyr cultures and Icelandic ingredients on EU whey, stated plainly on the label.

Packaging concept

900 g stand-up pouches, matte soft-touch finish. Each flavour carries one of the Dritvík lifting stones and its weight, so buyers collect the set from Amlóði 23 kg to Fullsterkur 154 kg. Custom-printed pouches cost roughly €0.60–1.20 each at 2,000–5,000 units.

Order of launch: 1 and 2 first (same manufacturer as Grace), then 3, then equipment and the camp once the brand has a following. Apparel waits for ÞEL's materials. Names of living strongmen and the "World's Strongest Man" mark are licensed property; the heritage, places and stones are free to use.

Shares its EU manufacturer, lab testing and notifications with Grace, so the real cost of adding it as a second brand is lower than the figures suggest. Strongmen's names and likenesses and the "World's Strongest Man" name are licensed property: use the heritage, not the people, unless an ambassador signs.

Grace — a midlife wellness company for Europe

Six clean, physician-formulated supplements for women in perimenopause and menopause, bundled with a doctor-led eight-pillar lifestyle membership and bookable telehealth. The bottle is the entry; the doctor is the moat.

Business plan3D products

CRA Desk — Cyber Resilience Act reporting for small product makers

Since 11 September 2026 anyone placing a product with digital elements on the EU market must report an actively exploited vulnerability or a severe incident within 24 hours, with a follow-up at 72 hours and a final report within 14 days. Thousands of tiny makers — smart-home gadgets, Shopify apps, WordPress plugins, firmware shops, industrial sensor vendors — have no process, no single-reporting-platform account and nobody awake at 3 a.m. CRA Desk sells a reporting-ready kit (templates, platform onboarding, a tested runbook) plus an on-call service that drafts and files the report when it happens.

Why now

• Reporting obligations are live now; full product requirements with CE marking follow on 11 December 2027, so demand only grows.
• Products already on the market are exempt from the design rules but not from reporting — the installed base is the customer.
• Conformity bodies are active since June 2026; small makers cannot ignore it and cannot staff it.

Offer and price

• Ready kit, €490 once: templates, platform account, runbook, one tabletop drill.
• Desk, €149/month: on-call drafting and filing, 24/7, plus an annual drill.
• Desk for agencies, €390/month: covers up to ten products of a software agency or MSP.

Near-zero marginal cost until an incident; the founder already works on-call rotas. Twenty Desk customers is €3,000 a month.

PayGap — pay-transparency reports for mid-size companies

The EU Pay Transparency Directive requires employers with 100 or more employees to report their gender pay gap and justify any gap above 5%. Member states must transpose it by 19 March 2027, and the first reports fall in 2027. HR managers at mid-size German and Austrian companies will have to turn a payroll export into a compliant report, and their payroll software mostly will not do it. PayGap is a web tool: upload the export, map the columns, get the report, the category breakdown and the plain-language explanation the works council will ask for.

Why now

• A hard legal date with a named reporting duty and a named audience (HR, works council, labour inspectorate).
• Large employers have consultancies; the 100–500 band has nobody and a spreadsheet.
• Switzerland already runs the Logib equal-pay analysis for 100+ staff — the same buyer, the same data, a second use.

Offer and price

• Report, €490/year per legal entity: unlimited reports, exports in German and English.
• Advisory add-on, €900: a one-hour review with an HR lawyer partner.
• Treuhänder plan: resale pricing for accountants and payroll bureaus serving many firms.

Pure software margin. One payroll bureau with 40 client firms pays for the whole build.

AI Audit — transparency and literacy for small companies

The AI Act's transparency rules have applied since 2 August 2026: a chatbot must say it is a machine, generated images and text must be labelled, and employers using AI in hiring face high-risk duties from December 2027. The AI-literacy duty for every company using AI has applied since February 2025. Most small firms have a chatbot on their website, a marketing team using image generators and an HR tool with an AI filter — and no idea any of this applies. AI Audit is a half-day: inventory every AI touchpoint, grade each against the rules, fix the disclosures, and run the two-hour "KI-Kompetenz" training the law expects.

Why now

• Rules in force now, enforcement powers in force now, and a December 2027 high-risk date that makes HR tools urgent.
• Every web agency has clients who need this and no one to send them to.
• Training is a documented duty, which means a certificate people will pay for.

Offer and price

• Audit, €900: inventory, grading, fixes, written report.
• Training, €600: two hours for up to 20 staff, certificate per person.
• Agency bundle: audit plus training for an agency's clients at a resale rate.

A day of work per client at €1,500; the content is written once. The ceiling is the founder's hours, which is why the agency channel matters.

Scam Shield — fraud protection for seniors

Fraud against the elderly is the fastest-growing crime category in Switzerland and Germany: fake police calls, grandchild emergencies, fake bank security, romance scams, QR-code parking fraud. The victims are over 65; the buyers are their children, who live far away and worry. Scam Shield is a subscription: harden the phone and the messaging apps, set up call filtering and a payment delay with the bank, a monthly ten-minute check-in call, a "verify before you pay" hotline, and a recovery service if it happens anyway. Twelve years in national police IT security is the credibility nobody else selling this has.

Why now

• An ageing population, a crime category growing double digits, and children who will pay for peace of mind.
• Banks and police run awareness campaigns but offer no personal service.
• Non-intrusive by design: setup, education and a hotline, never access to accounts.

Offer and price

• Setup, €290: a two-hour visit or video session, phone and apps hardened, bank measures arranged.
• Shield, €29/month: monthly check-in, hotline, scam-alert messages in plain German.
• Recovery, €490: evidence, bank and police contact, account lockdown after an incident.

Service hours at setup, then near-zero cost per month. A hundred households is €2,900 a month of recurring income.

Briefing — EU deadlines for Swiss exporters

Swiss companies sell into the EU but sit outside its regulatory conversation, and the next eighteen months are brutal: Cyber Resilience Act reporting now and full compliance in December 2027, Digital Product Passports for textiles and steel, EUDR, the AI Act, e-invoicing, the EU Digital Identity Wallet. A Swiss machine-parts or cosmetics maker will hear about each one from a customer's questionnaire, too late. Briefing is a monthly German-language email plus a quarterly call that says exactly which rule applies to which kind of Swiss firm, by when, and what the minimum response is. It costs almost nothing to run and is the top of the funnel for CRA Desk, PayGap, AI Audit and Guardian.

Why now

• Forty-plus EU deadlines land between now and 2028 and Swiss firms have no national body translating them.
• Trust is built by being right and early, twelve times a year.
• Every subscriber is a warm lead for four other ideas on this board.

Offer and price

• Free: a monthly headline email.
• Briefing, €18/month: the full briefing, a per-sector applicability table, the quarterly call.
• Team, €49/month: five seats and a question line.

An evening a month to write. Two hundred paying subscribers is €3,600 a month and a mailing list that sells everything else.

Front Desk — an Icelandic AI front desk for tourism

Two million visitors a year, a few thousand small operators, and a language too small for the big chatbot vendors to care about. Guesthouses, tour companies and rental firms answer the same two hundred questions by email and WhatsApp at midnight: check-in, weather, the road to the glacier, cancellation, where the hot tub is. Front Desk is a bilingual assistant per property that answers from the owner's own information, takes booking requests, and hands anything odd to a human. Built by one of very few people who can write it in Icelandic and talk to the owners in their own language.

Why now

• Tourism is Iceland's largest export and chronically short of staff.
• Icelandic language technology is a stated government priority, with public models and funding.
• Every operator already has the content; nobody has packaged it into an assistant.

Offer and price

• Property, €79/month: website and WhatsApp assistant, Icelandic and English, owner dashboard.
• Group, €249/month: up to five properties.
• Setup, €390: content ingestion and a two-week tuning period.

Hosting and model costs under €10 per property per month. Fifty properties is €4,000 a month.

Restore Proof — restore testing as a service

Everyone backs up; almost nobody proves a restore works until the day it doesn't. Auditors, cyber insurers and NIS2 questionnaires now ask the same question — when did you last restore, and can you show it? Restore Proof is a scheduled quarterly restore test of agreed systems into an isolated environment, timed, documented, and signed off in a one-page report the customer can hand to an insurer. It sits beside Guardian rather than inside it: Guardian evidences that backups exist and are protected, Restore Proof evidences that they come back. It is the Veeam work the founder already does for a central bank.

Why now

• Insurers want tested restores within the last 90 days with documented results.
• NIS2 names backup and disaster recovery as an evidenced control; supply-chain clauses push the question to Swiss suppliers.
• MSPs promise restores in every contract and rarely have the hours to prove them.

Offer and price

• Quarterly, €290/quarter per site: one agreed restore scenario, report, remediation notes.
• Monthly, €190/month: a scenario a month, rotating through systems.
• MSP white label: per-client pricing under the provider's own name.

Two to four hours per test, mostly automated with Veeam SureBackup and scripts. Forty sites on quarterly is €4,600 a month.

Legacy Vault — what happens to your digital life

Accounts, crypto, domains, photos, subscriptions, the password to the family NAS: when someone dies, the family spends months guessing. The question is being asked quietly in every household with a parent over fifty, and the German-speaking market has no serious, trusted provider. Legacy Vault is a guided inventory with no passwords stored in plain form, sealed instructions per asset, a named trustee, and a verified release process tied to a death certificate. Trust is the whole product, which is why hosting in Switzerland and a notary channel matter more than features.

Why now

• Digital assets now exceed physical ones for many people under seventy.
• Estate lawyers and notaries get the question weekly and have nothing to recommend.
• Swiss hosting and Swiss data-protection law are a sellable trust signal across Europe.

Offer and price

• Vault, €59/year: inventory, sealed instructions, one trustee.
• Family, €119/year: up to four vaults, shared trustee.
• Notary edition: offered through estate lawyers at a referral fee.

Software margin, but acquisition is slow and emotional. A notary channel is the only cheap one.