New startup ideas · B2B, security and compliance · Security and compliance
startup idea
Vendorproof
An exchange where small vendors sell machine-verifiable proof that their security controls held.
Small software and services vendors connect their cloud, identity and endpoint tools once; Vendorproof produces cryptographic proofs that a named control held over a named time window, without exposing raw logs.
- Marketplace
- Small business
- $10-100B market
- Network effects, winner takes most
- US first
3/5
venture judge
0
similar startups, last 2 years (21 all-time)
98%
of 4 nearest real companies still alive
yes
3 matching federal grants and programs
Direction supported by government programs and grants
Scorecard
One score that balances how trendy the idea is, the demand for it and its potential for 100x, with competition measured relative to every other idea in the catalog. Recent startup trends first, government priorities second.
90
Idea Score, 0-100 · raw 54.8 x 1.64
Open
competition: more crowded than 6% of ideas · headwind x0.97
+1.5
government priorities, secondary (3 matching grants)
Trend
43
Is the wave forming now? 2025-26 entrants vs 2023-24, rounds since 2025, the sector's live-batch direction, the 2026 trend analyst.
- Entrants 2025-26 vs 2023-24 (similar companies)23
- Rounds announced 2025+ in the sector25
- Sector direction (live batch)100
- 2026 trend analyst25
Demand
62
Does anyone want it? YC's current RFS, companies already paid for something similar, the operator judge, founders' yes-rate in decks, readers who would run the test.
- YC asks for it (current RFS: idea / sector)60
- Someone already pays (similar companies, recent / all-time)100
- Operator judge: real pain25
100x potential
62
Can it return a fund? The venture judge (double weight), market-size and moat axes, neighbours still alive, the technologist judge.
- Venture judge50
- Market size axis67
- Moat axis100
- Neighbours still alive32
- Technologist judge75
Score = 100 x cbrt(Trend x Demand x 100x) x (1 - 0.5 x crowding) + government bonus (max 5), calibrated so the 95th-percentile idea scores 90 (order never changes). A geometric mean: a weak pillar cannot be papered over. Percentiles are among the 272 ideas in the catalog; the terms matched were exchange, vendors, sell, machine-verifiable, proof, connect, cloud, identity.
The idea in full
- What
- Small software and services vendors connect their cloud, identity and endpoint tools once; Vendorproof produces cryptographic proofs that a named control held over a named time window, without exposing raw logs. Buyers running vendor reviews query the exchange and pay per verified proof pack instead of mailing spreadsheets. Vendors list for free and pay a take rate on each proof delivered, so a proof produced for one buyer is resold to the next twenty.
- Why now
- The compliance side of this cluster is filling up with document generators (Probo, ComplyDo, Regbase, Sparkle AI, ComplyBridge, Inc.), and YC's Fall 2026 RFS asks for AI-Native Compliance Infrastructure rather than more questionnaire software. JumpWire (2022), which tried dynamic access controls across all data stores, is in the graveyard because it needed to sit inline; proofs over telemetry commitments do not.
- Wedge: first customer and entry point
- US managed IT and dev shops selling into mid-market buyers: cover exactly three controls (MFA enforcement, backup restore tested, endpoint encryption) and let one buyer verify a hundred of its small vendors.
- Path to 100x
- Vendor risk and security assurance sit inside a $10-100B GRC and third-party risk spend, and this is a classic exchange: every buyer that demands Vendorproof drags in its vendor tail, and every listed vendor pulls in its other buyers. Once a proof format is what buyers ask for by name, it is winner-takes-most because a second exchange means re-proving everything.
- Ceiling
- The proof system takes three years to earn trust while a large incumbent GRC vendor simply declares its own attestation format and ships it to an installed base.
- Closest real companies, as the generator saw them
- Probo, ComplyDo and Sparkle AI make one company look compliant on paper for an auditor. Vendorproof makes a claim independently checkable by a counterparty and reusable, so its unit is a transaction between two firms, not a subscription to a document.
- Main risk
- Buyers keep accepting PDFs because nobody is punished for accepting a weak one, so the demand side never pays for verified proof.
Five judges
Each judge scores every idea in the catalog with a named rubric; the venture judge decides whether a card is shown at all (4-5 is venture-grade).
Venture investor
3/5
Genuine two-sided exchange in $10-100B GRC spend, but three years of R&D against buyers who face no penalty for accepting PDFs.
Bootstrapper
1/5
R&D first with revenue after three years, and buyers still accept PDFs, so nobody is paying while the proof system earns trust.
Operator
2/5
The card admits buyers keep accepting PDFs because nobody is punished, so the side that must pay feels no pain.
Technologist
4/5
Proofs that a control held over a time window without exposing raw logs is genuine crypto engineering, and each proof pack resold to twenty buyers compounds.
Risk
4/5
Unregulated, self-serve, and reads telemetry from many tools rather than sitting inline, so no one vendor's terms change can switch off the exchange.
trends
2/5
The AI-Native Compliance Infrastructure RFS fits, but cryptographic control proofs were possible years ago and no dated 2025-2026 shift forces buyers off PDFs now.
Similar startups in the directory
Companies whose pitch matches most of the idea's terms (exchange, vendors, sell, machine-verifiable, proof, connect, cloud, identity): 21 all-time, 0 from the last two years. Same matching as Idea Check.
A quantum communications startup using quantum tech to solve communication, information, and security challenges.
Developer of a healthcare platform designed to ensure better outcomes through the use of diagnostic tests and lab reports. The company's product digitizes collected data from disparate hardware providers, interprets it, and then creates analytics dashboards to see how both individual patients and groups of patients are doing, enabling healthcare providers to determine treatment plans and pharmaceutical options for patients.
Operator of a peer-to-peer fashion marketplace intended to connect buyers and sellers for online shopping. The company offers a marketplace that is a mix of a social network and a forum where people like and comment on the articles posted and give each other fashion tips, enabling customers to buy, sell, exchange, and review new and used fashion items with ease.
Operator of a web-based platform intended for restaurant supply management. The company's marketplace offers tools to find vendors and buy or sell fresh ingredients effortlessly through its connective marketplace and order management system, enabling clients to increase their business transaction efficiency, and information transparency and improve profitability.
Developer of a personal DNA cloud data upload application designed to make people connect DNA data with insights, products, and research. The company's platform allows members to upload their raw DNA data files and discover their DNA identities and traits through intuitive visualization and scientific-educational content, enabling members to learn about their DNA data while ensuring ultimate transparency.
Developer of cloud-based point-of-sale software designed to help retailers to digitize their business. The company's software develops a cloud-based point-of-sale system that offers real-time reports, inventory management, and customer data collection that help to connect the long line of less sophisticated physical traders online, enabling users to digitize their finances and inventory management.
Accelerating Histopathology for Cancer Research
Quantum-secure root of trust for IoT.
Developer of a cloud-hosted identity and access management software designed to focus on higher education. The company uses managed solutions to support multilateral federations to enable participation in InCommon and eduGAIN for identity and service providers, enabling affiliated users like applicants, parents, alumni, and continuing education students to get support for onboarding and authentication.
Provider of a cloud-based drop-shipping platform designed to provide product push and predictive supply chain, models. The company's online platform integrates and manages drop ship partners, inventory, data, and orders by handling the exchange of data through a single connection and integration point, helping trading partners streamline operations, generate more sales, and fulfill more orders using the virtual supply chain.
Simple password & identity management for teams. Acquired by LogMeIn…
The generator's reference companies
Real companies the model named as closest when it wrote the card, with their fate. A check mark is a company the radar could verify in its directory.
Public money in this direction
US federal grants, SBIR/STTR awards and open opportunities from the radar's public-money feed, matched to the idea's terms; the sector totals give the context.
3
grants and programs matching the idea
73
startup-relevant grants in Security and compliance
$18M
awarded in the sector, tracked
23
opportunities open now in the sector
- VINES: Track 1: REGAIN: Resilient and Energy-Efficient Generative AI for Secure Hospital Robotics over NextG Networksawardmedium relevance
National Science Foundation · Use-Inspired NextG · $912K · posted 2026-08-02
- NSF PCL-Test Bed: SPEED: Programmable Cloud Laboratories for Autonomous Chemistry and Materials Discoveryawardmedium relevance
National Science Foundation · PCL-Programmable Cloud Labs · $20M · posted 2026-07-21
- Category II: Transitioning the National Science Data Fabric Pilot into a National Operational Cyberinfrastructure and Service for Democratized, AI-Driven Scientific Discoveryawardmedium relevance
National Science Foundation · NAIRR-Nat AI Research Resource · $9M · posted 2026-05-22
Market signal
What the radar sees in Security and compliance: new companies by cohort year, the forming YC batch, and outcomes since the February snapshot.
Security and compliance · 42 → 45 → 83 → 75 → 32 new companies 2022 → 2026 · 94% aliveYC S26: 7 in this cluster, 3% of the batch (was 3% in X26) (F26 is still forming: 21 listed)Since February, of 171 YC companies here: 0 acquired, 2 shut down, 24 rewrote their pitch
Design attributes
The card is one cell of a designed set: every axis below was chosen before the text was written, and the text had to realize it.
- Buyer
- Small business
- Business model
- Marketplace
- Path to 100x
- Network effects, winner takes most
- Market size
- $10-100B market
- Capital intensity
- Capital-medium (ops, field teams)
- Speed to revenue
- R&D first, revenue after 3 years
- Technical depth
- Deep tech: ML, hardware, bio
- Go-to-market
- Self-serve
- Moat
- Network effects
- Geography
- US first
- Regulation
- Unregulated
- Vibe
- Boring business
Listed under
An idea sits in its own sector and in any sector its text clearly touches.
More ideas like this
B2B, security and compliance · Security and compliance
Claimyard
Marketplace turning scam, fraud and privacy losses into funded, aggregated consumer claims.
A consumer uploads what happened, screenshots of a romance scam, an unauthorized P2P transfer, a data misuse notice, and a no-code intake agent classifies the claim, pulls the paper trail from the bank or platform, and posts it to a marketplace of licensed attorneys, arbitration filers and litigation funders who bid to take it on contingency.
B2B, security and compliance · Security and compliance
Sentinet
Shared-defense agent for small firms: one member's confirmed fraud warns the whole network.
Sentinet connects in an afternoon to an SMB's mailbox, accounting system and bank feed, and runs an agent that screens invoices, vendor bank-detail changes and unusual logins.
B2B, security and compliance · Security and compliance
Vouchline
One AI agent answers your security questionnaires and reviews the ones you send.
Vouchline is an agent that sits on both sides of the vendor security review: for a small supplier it reads the buyer's questionnaire, pulls evidence from Drive, ticketing and cloud consoles, and returns a completed response in a day; for the buyer it reads incoming responses and flags the answers that contradict prior filings.
B2B, security and compliance · Security and compliance
Attestral
Agents that prove and verify vendor security continuously, replacing the questionnaire.
Attestral deploys agents inside an enterprise's stack that collect live control evidence and answer any customer's security review automatically; on the buying side, its agents interrogate a vendor's agents and check every claim against machine-readable evidence rather than prose.
B2B, security and compliance · Security and compliance
Codewarden
Continuous security for the AI-written software small businesses now run on.
Codewarden is a self-serve subscription platform that continuously scans, exploits and patches the AI-generated applications small businesses now build and deploy without security staff.
B2B, security and compliance · Security and compliance
Ironvane
Autonomous security operations agents that managed service providers resell and extend.
Ironvane gives managed service providers a runtime where security agents triage alerts, patch endpoints, revoke credentials and close tickets across their whole book of small business clients, with the provider approving actions rather than performing them.
Fictional company written 2026-08-23 from MarkosWeb data; the companies, grants and numbers around it are real and tracked. Treat the idea as a research prompt, not a plan.