SMEs and mid-market companies need access to offensive cyber tools to identify key vulnerabilities in their systems, which are currently gated or only available to adversaries.

Target User

Small to mid-sized enterprise IT security teams or consultants

Product Idea

A web tool that allows SMEs to run controlled, non-destructive offensive pen-tests against their own infrastructure using a fine-tuned LLM, focusing on identifying specific vulnerabilities.

Evidence

• “Anthropic and OpenAI's publicly available models are explicitly guard-railed so that they refuse offensive tasks. And their cyber-focussed models are gated for enterprises. This leaves SMEs and mid market open to major vulnerabilities. +”

  https://news.ycombinator.com/item?id=48609231

Why this opportunity matters

This opportunity surfaced from multi where Small to mid-sized enterprise IT security teams or consultants are actively describing the problem in their own words. We classified the demand intensity as high — meaning users are not just complaining, they are openly looking for paid solutions and willing to switch tools to find one. When users self-select to post a problem on a public platform like multi, they are usually already trying to solve it — which makes them strong candidates for the right paid alternative.

How to validate this before you build

Before writing a single line of code, three lightweight steps will tell you whether this opportunity is worth pursuing:

1. Read the original conversation. The evidence links above lead to the exact threads where users described this problem in their own words. Read every comment — what people argue about in the replies often matters more than the original post.
2. Talk to five real users. Find five people who match the target user description above and ask how they handle this today. You are looking for two signals: a consistent workaround they hate, and a willingness to pay for something better. If both show up in three of five conversations, the demand is real.
3. Test willingness to pay before building. Put up a one-page landing site describing the proposed product, with a deposit or pre-order checkout. If even a small fraction of traffic converts to a real payment, you have validated more than most products that ship to production.