The three ideas, judged

Three ideas were on the table at the start of this research: post-train a defensive cyber model and score well on benchmarks; build a security-review agent that checks every PR; release an open benchmark. After the research, none of them survives in the form it was proposed, and one of them survives in a stronger form than it was proposed.

The structure below is deliberate. Each verdict has a call, the evidence that produced it, what would have to be true for it to work, and kill criteria — specific, dated, falsifiable conditions under which you stop. Kill criteria that cannot be checked are decoration. These can be checked.

#Idea 1 — Post-train a defensive cyber model

#The evidence

Nobody has publicly demonstrated a post-trained model beating a frontier model plus good scaffolding on agentic security tasks. Not Cisco, whose Foundation-Sec is the only open security model with real product distribution and whose own Foundation-Sec-8B-Reasoning checkpoint loses to GPT-5-Nano on Cisco's own CTI-Reasoning benchmark. Not Trend Micro. Not any of the hobbyist fine-tunes (Open-weight security models). The security-specific post-training literature is thin: SVEN, SafeCoder and HexaCoder are pre-RLVR steering methods aimed at secure code generation, not agentic vulnerability hunting, and Minerva — RLVR for threat-intelligence mapping with deterministic verifiers — is the cleanest precedent anyone has, on a narrow classification-shaped task (Post-training playbook).

Meanwhile the agentic-coding RL recipe is mature and reproducible. SWE-RL, SWE-Gym, SWE-smith, R2E-Gym, DeepSWE and Kimi-Dev all converge on the same shape: containerized task, verifiable reward, GRPO-family algorithm. DeepSWE's headline run was roughly 9,216 H100-hours, on the order of $30–37K of compute. That number circulates as "what it costs to post-train a model." It is a lower bound on one run. A real twelve-month program with a five-person team is $1.2M–$2.5M all-in, dominated by salary and iteration, not by the headline GPU bill (Unit economics and the compute bill).

And there is a specific warning sign for the defensive direction. CyberSOCEval found that reasoning and test-time compute — which reliably improve offensive task performance — do not produce the same gains on SOC-analyst tasks (Cyber benchmarks and evals). If defensive tasks are structurally less responsive to the thing post-training is best at, the capability case gets weaker, not stronger. That finding is about SOC triage specifically and may not transfer to code-shaped defensive tasks like exploitability validation, which look more like the offensive benchmarks. But it is a live risk that has to be tested, not assumed away.

#What would have to be true

• Review volume high enough that inference cost, not capability, is the binding constraint — roughly 10,000–60,000 deep reviews a month, or 500–3,000 active developers (Unit economics and the compute bill).
• Or a deployment constraint that frontier APIs cannot satisfy: air-gapped, on-premises, or a regulated buyer with a hard no-third-party-inference rule. This is the more likely early trigger in Europe, and it is a sales requirement long before it is a cost saving (Who buys, and what they pay).
• A verifier you trust. The reward signal is the whole program. "Patch applies and the proof-of-concept no longer reproduces and the regression suite is green" is clean. Test-suite-pass alone, SARIF ground-truth matching, and LLM-judge rewards are all reward-hackable in documented ways (Post-training playbook).
• Training environments you did not have to build from nothing. ARVO's ~6,100 reproducible OSS-Fuzz vulnerabilities turn a multi-year infrastructure problem into one to two engineer-quarters (Data, and whether a moat is possible).

#Idea 2 — A security review agent on every PR

#The evidence

The idea as stated lands in the most crowded part of the market. Posting security comments on pull requests is free from GitHub and Cursor, cheap from CodeRabbit and Greptile, and offered by every AppSec vendor. Anthropic ships a Claude Code security review. OpenAI's Aardvark became Codex Security. There is no price point at which a thin wrapper wins that fight, and the platform risk is not theoretical: Aardvark went from invite-only to broad enterprise rollout in about four months (AI code security companies, What the frontier labs do themselves).

What is not solved by anyone — including the labs — is the layer underneath:

Layer	State of the art	Who owns it
1. Comment on a diff	Commoditized, free or near-free	GitHub, Cursor, CodeRabbit, Greptile, every lab
2. Validate exploitability — is this actually reachable and triggerable?	Largely unsolved, no standard benchmark	Nobody
3. Whole-repo reasoning — cross-file, cross-service, architectural	Unsolved at scale	Nobody
4. Trustworthy autofix, merged without a human gate	Not claimed by anyone, including Google's CodeMender	Nobody

Every vendor precision number in this market is self-reported on a self-chosen set: Semgrep's 96%, Aardvark's 92% recall, Greptile's 82%. None has been independently audited, and they are not comparable to each other (AI code security companies). False positives are the most consistently documented buyer complaint across every SAST tool (Who buys, and what they pay). The market's problem is not that it detects too little. It is that it cannot tell you which detections are real.

AIxCC gives the sharpest read on what is achievable. Autonomous systems found 86% of 63 synthetic vulnerabilities and patched 68%. On real-world bugs, every successful patch was Java; zero C bugs were patched (AIxCC: the closest thing to a proof). That is a roadmap instruction: memory-safe languages first, and treat C/C++ remediation as discovery-only for the foreseeable future.

Then the commercial layer. CRA Article 14 obligations begin 11 September 2026 and the regulation applies fully on 11 December 2027, making vulnerability handling, SBOMs and security updates mandatory for products with digital elements sold in the EU (EU regulation as a demand engine). A verified defect with a reproduction, a patch and evidence the patch works is not just a better security finding — it is the artifact a CRA-exposed company needs to demonstrate it handled a vulnerability. That is the difference between selling a nice-to-have to an engineering manager and selling a compliance obligation to someone with a deadline.

#What would have to be true

• You can validate exploitability at a materially better rate than a general reviewer, and demonstrate it on a benchmark you publish along with the held-out set and methodology — which alone would differentiate you, because no competitor has done it.
• Design partners exist who feel the CRA date. German Mittelstand manufacturers and financial infrastructure firms have board-level urgency and a reason to work with an early vendor (Go to market).
• The unit economics survive. At $25–60 per developer per month, a uniform deep-review-on-every-PR design does not work; tiered triage with cheap first-pass and selective escalation is an architectural requirement from day one, not an optimization (Unit economics and the compute bill).
• Self-hosted and bring-your-own-key deployment exist before the first enterprise conversation, not after (Who buys, and what they pay).

#Idea 3 — Release your own benchmark or eval

#The evidence

No benchmark in this space generates revenue for its maker. Cybench, CyberGym, NYU CTF Bench, BountyBench, AIRTBench, CyberSecEval — all produce citations, occasionally a relationship with a frontier lab's safety team, and nothing that resembles a customer (Cyber benchmarks and evals). Meta's CyberSecEval, the most-cited name of all, has gone quiet on public leaderboards.

The adoption bar is also higher than it looks. What gets a benchmark into a frontier system card is not novelty — it is government co-validation. UK AISI and US CAISI involvement is what converts an academic artifact into something the labs report against. Only Cybench and CyberGym have crossed from academia into all three labs' disclosures (Cyber benchmarks and evals).

But there are two genuinely unclaimed positions, and both are cheap:

The defensive full-loop gap. There is no continuously-refreshed, cost-denominated benchmark that scores triage → root cause → remediation end to end, and no standard "review this diff for vulnerabilities" leaderboard at all. Defence is roughly where offence was in mid-2024.

The independent-evaluation gap. This is the more immediately valuable one. Vendor claims in this market routinely contradict independent testing — Strix, the most-starred offensive agent on GitHub with a category-leading star count, scored 1 out of 20 on an independent benchmark where a rival scored 45% and a commercial tool 75% (Strix). Nobody is systematically publishing reproducible third-party evaluations of AI security agents. In a market where every number is self-reported, being the group that publishes methodology, held-out sets and reproducible harnesses is a position with almost no competition.

#What would have to be true

• The benchmark is narrow and attached to a product claim — "our agent scores X on a diff-validation benchmark we built and open-sourced, here is the harness" — following the CyberGym and BountyBench playbook rather than CyberSecEval's broad-suite approach.
• It is continuously refreshed from non-public sources, or it saturates within 12–24 months on public writeup contamination like every CTF benchmark before it.
• You budget it honestly: a 10,000-task verifiable benchmark is a 25–50 engineer-month, $500K–$2M undertaking within the memory-safety class (Data, and whether a moat is possible). A first useful release is far smaller than that, and should be.

#The ranked alternatives

The three ideas were not the only options the research surfaced. Ranked by fit for a small, technical, Berlin-based team:

#	Wedge	Why it ranks here
1	Verified defect engine — reproduce, patch, prove, on memory-safe languages, sold on the CRA clock	The recommended path. Unsolved layer, dated demand, defensible on verification infrastructure
2	Independent evaluation authority for AI security agents	Almost zero competition, very cheap, compounds into #1's credibility. Not a business alone
3	CRA/NIS2 compliance-evidence automation	Strongest dated demand in the research; risks becoming a document generator rather than a technical product
4	Evaluation-environment security — securing the sandbox, not the model	A real category created by 2026's containment failures, currently unowned. Different company, different buyer (Dual-use risk and what it costs you)
5	Agent authorization brokering — scope-fencing for autonomous agents acting on real systems	Ranked highly on demand signal in What AI is actually doing to the threat landscape; unresolved legally in every jurisdiction, which is both the opportunity and the risk
6	Application-map-as-a-service for offensive agents	Directly addresses the documented black-box failure mode; small market, sells to competitors
7	Defensive full-loop benchmark as a standalone effort	Real gap, but needs an AISI/CAISI relationship to matter and produces no revenue
8	Post-trained on-prem defensive model for air-gapped buyers	Real demand, but a capital-intensive bet to make before you have the customers who need it
9	AI SOC triage	Crowded, integration-heavy, and the segment where a research-capability edge counts for least (AI SOC and detection companies)
10	Autonomous pentest / offensive product	Well-funded incumbents, and §202c makes a German base actively hostile (Germany: §202c and the Berlin question)

#What this means for us

• Idea two is the company; ideas one and three are inputs to it. Sequencing them as alternatives is the mistake to avoid.
• Write the kill criteria into the operating plan with dates attached, and check them on those dates. The failure mode in this market is not picking wrong — it is not noticing you picked wrong for four more quarters.
• The single cheapest high-value action available right now is the independent evaluation. It costs weeks, it produces something nobody else has published, and it is the credibility ladder's first rung (The AI cyber lab category, The first 90 days).
• Before committing to any of this, resolve the three questions in Open questions and the research backlog that desk research cannot answer. Two of them are phone calls.