Countersign: the full plan.

At a glance Projection

Projection table: base case

Generated from model.json (v2). Revenue = average of opening and closing ARR plus non-recurring paid pilots. Gross margin n/m where negative.

Working concept: AI assurance evidence for regulated industries. The beachhead is the AI vendors that sell chatbots and agents into banks and credit unions, and the compliance-testing function inside those institutions. Brand: Countersign. A countersign is the second signature that makes a document valid, and also the challenge-and-response password between sentries. The product does both: it attacks the AI, then signs off on the evidence. Tagline: Attack your AI before anyone else does. Show your examiner the proof.

Integrity notice. Countersign is a concept. It has no customers, design partners, LOIs, partners, press or revenue. Every figure labeled projection is an output of the assumptions in model.json, built by model_build.py. Market, competitor, funding and exit figures carry source URLs. Where a figure is only reported or estimated, the plan says so. Version 1 of this plan and model is kept in ./v1/. §19 lists every red-team critique and what changed.

What changed in v2, in one paragraph. Three red-team reviews (investor, enterprise sales, CTO) found that v1 overstated investor returns through a cap-table bug, assumed sales efficiency no bank-focused vendor achieves, sold the first product to buyers who do not own the systems being tested, and missed a year of competition, including funded standard-setters. v2 fixes the math, rebuilds the model by segment with an explicit sales build, makes the vendor attestation and compliance testing the Year-1 product, and treats AIUC-1, HITRUST and the big security platforms as distribution or inputs rather than ignoring them. The corrected answer is less flattering: this is a credible $200-500M strategic-acquisition business with a thin tail to $1.5B+, and the seed round's chance of 30x is about 2-3%.

1. Executive summary

The pitch. U.S. banks and credit unions are putting LLM chatbots, copilots and tool-using agents into production. In an EY-Parthenon survey, 47% of U.S. banking decision-makers said their institutions had fully rolled out generative AI, up from 10% in 2023 (eMarketer). OWASP still ranks prompt injection as the #1 LLM risk and says no fool-proof defense is known (OWASP LLM Top 10 2025 via HackerOne). Researchers have turned a European bank's AI assistant into a phishing channel by sending it one bank transfer (blue41).

Most institutions below $10B in assets do not build these bots. They license them from chatbot, contact-center and digital-banking vendors. The vendor ships the changes and controls the test environment. The institution's compliance and third-party-risk teams carry the liability. Countersign serves both sides:

• The AI vendor runs Countersign against its product in CI. It gets attack-success rates with confidence intervals, finance-specific conduct checks and a time-stamped attestation it can share with every FI customer.
• The FI's compliance-testing and third-party-risk teams get an examiner-format evidence pack, a viewer on their vendors' attestations, and checks of their own configuration (fee schedules, Reg E timelines, disclosures) against what the bot actually says.
• Fintechs and larger banks that build their own AI get the same engine with CI hooks, a self-hosted runner and a dry-run agent proxy.

The wedge, restated. Pre-deployment attack testing is now a feature of the security platforms banks already pay for: Palo Alto Networks, CrowdStrike (buying Dreadnode), Zscaler, Cisco, Check Point, SentinelOne, and OpenAI's free, MIT-licensed Promptfoo (§6). Countersign does not compete on attack breadth. It sells the second- and third-line evidence workflow: deterministic compliance checks against the institution's own policy documents, examiner-format packs, peer benchmarks, and an evidence history. It ingests findings from PANW, CrowdStrike and Promptfoo as inputs, the way GRC tools ingest scanner output.

The compounding advantage, restated (§7). (1) An evidence history that becomes the institution's audit trail. (2) A peer benchmark panel built from derived, non-reversible metrics. (3) Distribution through standards that already exist: Countersign aims to be a recognized testing provider for AIUC-1 and HITRUST AI certifications and to put a finance annex (Reg E, Reg B, UDAAP, GLBA) into the questionnaires FIs already send vendors. v1 called a proprietary vendor-attestation exchange "the 30x hinge." v2 accepts that in a third-party-risk network the network effect goes to whoever owns the standard and the insurance. Countersign's realistic role is the testing engine that feeds those standards.

Headline numbers (base case, projection).

v1's base case had $81M ARR in 2033. v2's base case has $42M. The difference comes from shifting bank logos 6-12 months later, pricing the community tier at what that buyer pays, modeling no-growth NRR (~100-102%) for community banks and credit unions, and deriving sales cost from quota-carrying reps instead of asserting it.

Capital. Planned raises total $106M across five rounds: pre-seed $2M at $8M post (closes only with a CTO co-founder signed), seed $6M at $26M post (Q2 2028), Series A $18M at $80M post, Series B $45M at $200M post, and Series C $35M at $320M post (2032). Base-case cumulative burn is $66M through 2033 and $72M through 2034. EBITDA breakeven is about 2035. The Series C is sized to cover a 2.0x burn-multiple stress case ($86M through 2033), not only the base.

Honest odds of a 30-50x outcome. On the full base funding path, the seed round makes 30x at an exit of about $1.74B and 50x at about $2.89B. A $2M pre-seed at an $8M post makes 30x at about $0.73B and 50x at about $1.22B. Pure attack-testing companies have exited for $95-500M. The $1B+ AI-adjacent security exits (Securiti at $1.725B, Oasis at about $1B) went to companies that own a data or identity control surface (§14).

• The modeled bull case ($139M ARR in 2034, at 12x) returns 28.9x to the seed round. That is below 30x.
• Estimated probability that the seed round returns ≥30x: about 2-3%. ≥50x: about 1%.
• Estimated probability that the pre-seed round ($8M post) returns ≥30x: about 6% (range 4-8%). At a $6M post, about 8%.
• Most likely outcomes: failure or a tuck-in below preferences, about 75% combined. A strategic sale of $150-500M, about 18%.

Verdict. As framed, this is not a 30x seed bet, and a top-tier seed fund should pass on it as one. It is a defensible pre-seed bet for an angel only if three things are proven early: a standards or TPRM distribution position (AIUC-1, HITRUST or the SIG questionnaire), paid demand from compliance teams at banks that already hold a PANW or CrowdStrike entitlement, and a credible path into insurance and other regulated industries. Without those, it is a good $150-400M strategic-sale business.

2. Problem and customer

Who exactly

The base is 4,287 federally insured credit unions at year-end 2025 (NCUA) and about 4,336 FDIC-insured banks. The bank figure comes from a secondary source citing the FDIC's Q4 2025 Quarterly Banking Profile (bankbonus); verify it against the FDIC. The asset-tier splits are analyst estimates and need checking against FDIC/NCUA call-report data before external use.

The key fact v1 missed. Banks and credit unions below $10B, and nearly all smaller ones, run chatbots from vendors such as the digital-banking platforms, contact-center AI providers and conversational-banking specialists. The institution has no CI pipeline, no release schedule and no prompts to change. Vendor contracts often forbid customer-run penetration testing of multi-tenant SaaS. So "continuous testing in CI" is not that buyer's problem. Their problems are (a) proving to examiners that they oversee vendor AI, which NYDFS explicitly expects (HackerOne summary of NYDFS AI guidance), and (b) knowing whether the bot says things about their fees, disputes and credit products that create UDAAP or Reg E exposure.

How they buy (revised)

• Vendor pays first. The vendor ships the changes, has the CI and can authorize testing. Countersign sells the vendor a continuous-testing subscription and a shareable attestation. The FI gets a free or low-cost viewer.
• At FIs, one budget owner: compliance testing. v1 proposed a CISO purchase co-signed by model risk management (MRM). SR 26-2 (April 2026) excludes generative and agentic AI and is aimed mainly at banks over $30B (Credit Benchmark; Forvis Mazars). MRM therefore has no mandate to own chatbot testing, and a two-buyer sale doubles the cycle. The function that already pays for conversation QA, mystery shopping and UDAAP/Reg E monitoring is the compliance management system (CMS) testing function. Countersign's conduct suites are positioned as "automated compliance testing of chatbot conversations." Security findings are the add-on.
• Buy the way banks already buy. Banks buy an annual assessment that the examiner can see. The entry SKU is an annual assessment plus quarterly retest. Continuous testing is the upsell.
• Vendor due diligence is mandatory. Banks run vendors through third-party risk management under the 2023 interagency guidance (OCC Bulletin 2023-17). Expect SOC 2 Type II, pen-test letters and data-flow diagrams, and plan for 3-6 months of diligence on top of a 3-6 month sales cycle. Exfiltration tests capture whatever a bot leaks, so diligence teams will treat Countersign as handling nonpublic personal information (NPI). The architecture responds to that (§10).

Evidence of pain (cited)

• Liability for what the bot says. A Canadian tribunal held Air Canada liable for its chatbot's misstatement (CTV). Financial chatbots make statements about fees, disputes and credit, which carry regulatory exposure.
• Regulator attention. The CFPB's 2023 Chatbots in Consumer Finance spotlight flagged noncompliance with federal consumer-financial law as a chatbot risk (CFPB PDF). NYDFS's October 2024 industry letter told covered entities to cover AI risk, including vendor AI, under Part 500 (Paul Hastings). Reuters reporting summarized by BERI says federal supervisors are asking banks how they would shut down AI agents (BERI).
• Breach economics. IBM's 2025 Cost of a Data Breach put the U.S. average at a record $10.22M (Help Net Security).
• Real exploit paths. The blue41 disclosure (indirect injection through a payment reference) and EchoLeak (CVE-2025-32711, zero-click exfiltration from Microsoft 365 Copilot) show that deployed guardrails can be bypassed (blue41; Coralogix).
• The validation gap. Treasury's March 2024 report records that LLMs are "very difficult to validate for high-assurance applications" (Debevoise summary).

Thin data, stated plainly. I found no publicly confirmed loss event in which a U.S. bank lost money or customer data through prompt injection against its own AI as of November 2026. The pain is anticipatory: risk, liability and exam readiness. Community-bank AI adoption also lags. An American Banker survey found 8% of community banks moving to enterprise-wide AI, against 51% of national banks (American Banker).

3. Solution and product

Countersign is an adversarial testing and evidence platform for AI systems at regulated institutions and the vendors that serve them. It is software. Expert services stay capped at about 10% of revenue.

1. Target registry and harness.
   • Black-box harness first. A browser and widget driver runs authenticated sessions against a test account in a vendor's sandbox or an FI's configuration. Voice (SIP) comes later.
   • Vendor CI integration for AI vendors and fintechs that ship their own code.
   • Self-hosted / VPC runner for anyone who will not let transcripts leave their environment. This moves from phase 2 to phase 1.
2. Conduct and compliance checks, in two tiers (the main change from v1).
   • Tier 1: deterministic, checked against ground truth. The customer uploads its fee schedule, Reg E error-resolution timelines, disclosures and product terms as policy-as-code. A finding is a contradiction between what the bot said and the customer's own source document. Each one can be verified and defended in front of an examiner.
   • Tier 2: judgment indicators. Possible UDAAP-risky framing, dispute deflection, collections-language risk and similar issues. These are labeled indicators. A human reviews them before they reach the evidence pack, and judge precision and recall are published per suite against a labeled holdout. Kill metric: if Tier 2 precision on design-partner data is below about 85%, Tier 2 stays out of the evidence pack.
   • Reg B / fair-lending tests run only with paired trials at stated sample sizes and confidence intervals. An underpowered test reports "insufficient power" rather than a pass. If this is not feasible at a sensible cost in the MVP, it is dropped from the MVP.
3. Security suites (commodity, included). Direct and indirect prompt injection, jailbreaks, system-prompt leakage, NPI exfiltration and tool misuse, mapped to OWASP LLM Top 10 and MITRE ATLAS. Countersign ingests findings from Prisma AIRS, CrowdStrike/Dreadnode, Promptfoo, PyRIT and garak and normalizes them into the same evidence pack.
4. Statistical results, not pass/fail. Attacks on a sampled model succeed probabilistically. Each finding reports attack success rate over N trials with a confidence interval. In CI, a fast fixed smoke suite runs with pinned temperature and seeds where the target allows. Gates trigger only on statistically significant regressions. Deep generative campaigns run nightly. Full replay context is stored: model version, system-prompt hash, retrieval snapshot and tool schema. That lets the platform distinguish "fixed" from "noise."
5. Agent and tool testing through a dry-run proxy. An intercepting tool-call proxy records the call an agent tried to make, such as a transfer, a card freeze or an address change, and checks it against an authorization policy without executing it. It runs in the vendor's or bank's staging environment and targets core and digital-banking developer sandboxes. A home-made mock core does not match real tool schemas, so v2 drops it. Agent testing is a separately priced SKU because setup is real work.
6. Framework mapping and evidence. Mapping targets are NIST AI RMF and its Generative AI Profile, the FFIEC IT Examination Handbook, NYDFS Part 500, ISO/IEC 42001, the OWASP LLM Top 10 and the EU AI Act. SR 26-2 is shown only as "principles applied by analogy, out of formal scope," because it explicitly excludes gen-AI (Anaconda; CRA). The schema is designed so that the output of the promised interagency AI RFI can be dropped in. The evidence pack covers scope, methodology, coverage with stated limits, findings, remediation, retest and trends across releases. Methodology independence, not hash-chaining, is what earns examiner trust, so the methodology is published and reviewed by paid former examiners and IT audit directors.
7. Vendor attestation (Year 1, not phase 2). The vendor's continuous results roll up into a dated attestation in a format AIUC-1 and HITRUST assessors can use as testing evidence. FIs see it in a viewer during TPRM.

What Countersign is not. It does not certify compliance, give legal advice, or sell a runtime firewall. It does not compete with platform red-team tools on attack breadth. It consumes their output.

4. Why now

1. Deployment is happening, unevenly. 47% of U.S. banks report full gen-AI rollout (EY survey, §1). Banks are piloting agentic AI in compliance, sales, credit decisioning and research (PYMNTS). Community banks lag (8% enterprise-wide, American Banker).
2. Agents raise the stakes. Tools turn a bad answer into a bad action. OWASP added "Excessive Agency" and "System Prompt Leakage" in 2025.
3. Standards for AI assurance are forming now, and that cuts both ways. AIUC raised a $15M seed and a $40M Series A led by Ribbit Capital (September 2026). Its AIUC-1 is a SOC 2-style certification for AI agents covering prompt injection, jailbreaks and unauthorized tool calls, and it is tied to insurance; KPMG is among the named certified companies (SiliconANGLE; SecurityWeek). HITRUST sells an AI Security Assessment and Certification that is validated by an authorized assessor and inheritable by relying parties (HITRUST; HITRUST blog). It added AI third-party-risk tooling in October 2026 (IT Brief). The window to become the finance-specific testing provider these standards rely on is open now and will not stay open.
4. The U.S. regulatory picture is a gap, not a mandate.
   • On April 17, 2026, the OCC, Fed and FDIC replaced SR 11-7 with SR 26-2 / OCC Bulletin 2026-13. The new guidance is nonbinding, excludes generative and agentic AI, and is aimed mainly at banks over $30B. The agencies said they would issue an AI RFI (Orrick; Sullivan & Cromwell). As of late October 2026, no RFI had appeared (BERI).
   • The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025 (CIS).
   • Under the EU AI Act Digital Omnibus provisional agreement, Annex III high-risk obligations, including creditworthiness, move to December 2, 2027 (Hogan Lovells; CMS). Confirm the final text.
   • Dated trigger. If no interagency AI RFI and no AI-specific exam expectation has appeared by June 30, 2028, plan on the bear case for the U.S. bank segments and shift the mix toward vendors, fintechs and the EU.
5. Consolidation shows strategic demand and closes the horizontal market. Twelve AI-security or AI-agent-security companies were bought, or reported as agreed to be bought, between August 2024 and November 2026 (§14). Two of those reports are not independently verified. Attack testing is being absorbed into platforms. The evidence workflow for regulated second and third lines is not.

5. Market size (bottom-up, projection)

Third-party reports on the AI red-teaming market disagree widely: 2025 base estimates run from about $0.34B to $1.45B (Credence, NextMSC, Spherical Insights, Technavio). The plan builds its own estimate. In v2, spend per entity is set equal to the model's own segment ACVs. So TAM, ACV and NRR reconcile by construction, which fixes v1's mismatch: a $32k average TAM spend against a $128k modeled book ACV.

What this says.

• The U.S. bank segment above $10B is only about $25M of 2030 TAM. Banks are the credibility customer, not the revenue base. That is why v2 frames the company as regulated-industry AI assurance with finance as the beachhead.
• Base-case ARR in 2034 is $59M, about 7% of 2034 SAM. Bull-case ARR is $139M, about 17% of SAM. That is category-leader share in a market that does not exist yet. The bull case needs the adjacent regulated industries to work: they contribute $21M of bull 2034 ARR.
• The <$1B channel row was the largest U.S. row in v1 and the least real. v2 nets out a 50% partner share and counts only 25% of it in SAM.
• The biggest single row, fintechs, rests on an assumed entity count. Treat it as the main market-sizing uncertainty.

6. Competition and positioning (updated November 2026)

Platforms (attack testing bundled into licenses banks already hold)

Independents and finance-specific players

Standard-setters (distribution, not competition)

Positioning, honestly stated.

• The vertical angle is not unoccupied, as v1 claimed. Finance-specific attack suites already exist and can be copied within a quarter. Assume PANW, Zscaler or Cisco can ship "FS compliance templates" within two quarters of seeing traction.
• Countersign competes on what is hard to copy quickly: (a) policy-as-code ingestion of each institution's own documents, which produces defensible Tier 1 findings; (b) examiner-format evidence validated by IT audit directors and former examiners; (c) the peer benchmark panel; and (d) standards recognition (AIUC-1, HITRUST, SIG).
• It sells to the second and third lines and to vendors' trust teams, and treats platform tools as suppliers. That is directly tested in the 90-day plan with compliance teams at banks that already hold a platform entitlement.

7. Moat: what compounds (revised)

1. Evidence history (workflow lock-in). After two exam cycles, the evidence trail is the institution's record of AI control testing. This is the most credible moat, and it grows with tenure and the number of systems covered.
2. Policy-as-code library. Each customer's fee schedules, disclosures and dispute timelines, structured into testable rules, make Tier 1 findings precise. Building that library across hundreds of institutions and vendor configurations takes time to replicate.
3. Peer benchmark panel, from derived metrics only. v1 claimed a raw attack-and-transcript corpus. The CTO review is right that large banks will opt out, that transcripts reveal configuration, and that successful attacks go stale within months. v2 contracts only for derived, non-reversible metrics: attack-family success rates by vendor, model and tier, and conduct-indicator rates by segment. "Your bot's Reg E deflection rate is 3x the median $10-50B bank" is the product. It becomes defensible at about 100+ institutions.
4. Standards position (distribution, not a proprietary network). If AIUC-1, HITRUST assessors or the SIG questionnaire reference Countersign's finance suites, every vendor seeking those certifications for FS customers becomes a prospect. The network effect belongs to the standard. Countersign's moat is being the default finance testing engine inside it. This is unproven and has a 12-month kill criterion (§17).
5. Paid labels. Tier 2 indicators need labels from former examiners and compliance analysts. That costs money (4% of revenue plus a fixed amount in COGS), which slows copycats as much as it slows Countersign.

What is not a moat: attack generation, finance-themed attack templates, framework mapping, or hash-chained evidence.

8. Business model and pricing (projection)

Retention, modeled by segment with downsell (steady state; expansion ramps up over the first three years).

Blended base NRR rises from 104% (2028) to about 114% (2030-34) as the mix shifts toward regional banks, vendors and adjacent industries. Through 2033, base ARR is built from $33.6M of new-logo ARR, $14.6M of gross expansion and -$6.7M of churn and downsell. Net expansion is about 19% of 2033 ARR. In v1, expansion was the single biggest driver. "AI systems per customer" is a tracked leading indicator from the first pilot.

Gross margin. COGS = inference (35% of revenue in 2027 falling to 15% by 2033; unmeasured, assumes N-trial statistical testing on mostly fine-tuned open-weight models) + paid labeling (4% of revenue plus fixed) + customer success (1 per $2.5M ARR) + 10% of R&D as research operations. Base gross margin is 62% in 2031 and 68% in 2033, below v1's 74-79%. The prototype must measure cost per run and cost per true finding, and those numbers replace the assumptions.

9. Go-to-market

First design partners: one vertical slice (none signed or approached)

v1 listed ten titles in ten segments, which meant ten different products. v2 runs one slice:

1. 2-3 AI chatbot or contact-center vendors that each serve 50+ FIs (vendor attestation; testing runs on their sandboxes, with their authorization).
2. 4-5 of those vendors' bank or credit-union customers, with the compliance officer as buyer (FI Compliance Assessment, viewer).
3. 1 CUSO (channel and shared-services view).
4. 1 pen-test or audit firm (channel: their annual AI assessment runs on Countersign).
5. 1 former examiner and 2 IT audit directors (paid advisors who validate the evidence format).

Pilot terms (proposed): $15-25k, under many credit unions' signing thresholds, on short paper with 90-day success criteria. Pilots convert to the attestation-plus-viewer model.

Channels (sequenced)

• 2027: vendors and fintechs, founder-led. About 70%+ of Year-1 logos come from buyers that do not run bank-grade TPRM. In the base case, all 5 paid 2027 logos are vendors and fintechs. Bank and credit-union design partners run paid pilots and prove the evidence pack.
• 2027-28: pen-test and audit firms as the first FI channel, at partner pricing. Annual assessment + quarterly retest matches how banks already buy.
• 2028: standards. Apply to be a recognized testing provider for AIUC-1 and for HITRUST assessors. Propose a finance annex through FS-ISAC, BPI or the Shared Assessments SIG.
• 2029+: regional and large banks after SOC 2 Type II and two reference customers. UK/EU entry ahead of the EU AI Act high-risk date. Adjacent regulated industries start in 2029.

How fast will anyone pay (projection)

• AI vendors and fintechs: first paid pilot 4-7 months from start; first subscription 9-12 months.
• Community banks and CUs (compliance buyer): pilots in 6-9 months; subscriptions in 12-18 months, mostly via vendors or partners.
• Regional banks: 15-24 months, gated on SOC 2 Type II and a reference.
• Large banks: 24+ months, with PANW, CrowdStrike, Zscaler and Mindgard in every bake-off.

Sales and marketing build (explicit in model.json)

• AE quota $700k new ARR at 68% attainment ($476k per ramped AE); new AEs are 40% productive in their first year; 15% AE attrition; $280k loaded cost per AE.
• 0.5 SEs and 0.4 SDRs per AE; 1 manager per 8 AEs; 1 partner manager per 30 partner-delivered logos; marketing programs at 30% of S&M people cost plus events.
• The founder covers the first $250k of new ARR in 2027 and in 2028.
• Result (derived, not asserted): blended S&M of about 1.8-1.9x new-logo ARR from 2030, against v1's asserted 1.3x. CAC payback on gross margin is about 33-36 months. That is long, and it is the honest number for this buyer.

10. Product and technology roadmap

Why Phase 4 moved up. The comparable exits (§14) show that pure attack-testing companies sell for $95-500M. Outcomes above $1B went to companies that own a control surface: Securiti for data, Oasis for non-human identity. If Countersign is to have a $1B+ path, the AI inventory and posture layer has to be part of the Series B plan.

Architecture principles.

• Bring-your-own-model abstraction from day 1. Attacker and judge models are mainly fine-tuned open-weight models that can run inside a customer's tenant (Azure OpenAI or Bedrock where required). Judges are qualified per model, and quality is reported per customer.
• Target-side call budgets are published per plan, because statistically valid testing raises the customer's own LLM bill.
• Attacker-model use goes only through providers whose terms allow red-team use, or through open-weight models.
• Transcripts stay in the customer's environment when the self-hosted runner is used. Only derived metrics leave.
• Evidence includes model version, prompt hash, retrieval snapshot and tool schema for replay.

11. Team and hiring plan

Founding team (today). The founding team brings security-testing leadership and financial-services relationships. Conditions before the pre-seed closes: a technical co-founder or CTO with LLM security and ML engineering depth, signed, who has signed off on the measured cost-per-run numbers. Before the seed: a compliance-testing or bank model-risk leader as co-founder, early hire or paid advisor.

Loaded cost: R&D $215k, G&A $190k, AE $280k, SE $220k, SDR $110k, CS $170k, all rising 3%/yr.

12. Financial plan (projection)

Base case

• Aggregate burn multiple for 2029-2033 is 1.49x. That is what the investor review called "typical" for this kind of company, against v1's implausible 0.09-1.0x.
• Cumulative burn: $66M through 2033, $72M through 2034. EBITDA breakeven is about 2035 at roughly $75-80M ARR.
• Stress test: if burn runs at 2.0x net new ARR from 2029, cumulative burn through 2033 is $86M. The funding plan (§13) is sized to that.

Bear (projection). Logos ×0.45, ACV ×0.8, half the expansion, +6 points of churn, fixed costs ×0.65. ARR is $2.7M in 2030 and $11.3M in 2033, NRR is about 95%, and the company still burns about $11M a year. It never earns a Series B. It runs out of cash in 2032 on $26M raised, so a realistic company sells or cuts hard around 2030-31.

Bull (projection). Logos ×1.7, ACV ×1.2, expansion ×1.2, -2 points of churn: the standards position and the adjacent-industry expansion both work. ARR is $18M in 2030, $61M in 2032, $95M in 2033 and $139M in 2034, with EBITDA positive in 2034. Bull 2034 ARR by segment: vendors $28M, regional banks $27M, large banks $24M, fintechs $23M, adjacent regulated $21M, community/CU $11M, partner-delivered $6M.

Unit economics (base, projection, illustrative)

• Blended S&M ≈ 1.8-1.9x new-logo ARR (2030-34). CAC payback on gross margin ≈ 33-36 months.
• Regional bank: ~$130k ACV, 119% NRR, 62% GM → 5-year gross profit ≈ $590k against ≈ $250k CAC → LTV/CAC ≈ 2.4x.
• Community bank / CU: ~$25k ACV, 101% NRR → 5-year gross profit ≈ $80k against ≈ $50k CAC → ≈ 1.6x. This segment is only worth serving through vendors and partners. Direct sales to it must stay small.

Why the base stops at $40-60M ARR

The U.S. bank market above $10B is about 155 institutions. Community banks and credit unions pay little and do not expand. Platforms compress price on security testing. The regulatory driver may never become a mandate. A focused $40-60M ARR company that sells for $200-500M is the most likely successful end state. Getting past $100M requires the adjacent regulated industries, the standards position and the Phase 4 control surface to all work.

13. Funding plan (projection)

• Total planned raise: $106M (v1: $71M). Base-case cash stays above about $0.6M at end-2027 (tight; the seed timing matters) and above $12M from 2029. Ending base cash in 2034 is about $34M. That reserve exists because the 2.0x stress case consumes about $20M more than the base.
• Fully diluted ownership at exit (after a 5% pre-exit refresh): founders 22.2%, option pool 11.6%, pre-seed 8.2%, seed 10.4%, Series A 13.7%, Series B 18.5%, Series C 10.4%, refresh 5.0%.
• Round prices are optimistic. The A, B and C posts above are about 25-35x forward ARR, which only a hot category commands. At $60M / $150M / $250M posts (about 20x), the seed's 30x threshold rises to $2.2B, and the bull case returns 22.7x to seed (later_round_price_sensitivity in model.json).
• Valuation realism at pre-seed. v1 used a $10M post with no technical co-founder and no design partners. v2 uses $8M post with the CTO signed as a closing condition. Carta data shows seed-to-Series A graduation rates falling every year from 2021 to early 2025 (Carta).

14. Investor returns

Comparable exits (updated; prices are press-reported unless stated)

The pattern. Pure attack-testing companies exit at roughly $95-500M. AI-adjacent security deals of $1B+ have gone to data, identity and posture platforms that own a control surface. v1 said no AI-security deal had reached $1.5B+. That was wrong: Securiti did, although it is a data-security company rather than a pure AI-security one. Kroll reports a 9.9x median EV/revenue for software cybersecurity M&A since January 2024 (Kroll). IMAP reports a 6.3x average for 2025 YTD software deals (IMAP). Treat all 2026 prices above as ranges.

Scenarios (projection; probabilities are analyst judgment)

Each scenario uses only the rounds its own funding path would raise. The waterfall is 1x non-participating preferred, pari passu, with conversion when better. v1's scenario table used stakes before its dilution reserve, which overstated every multiple by about 11%. That is fixed.

Exit value needed

In ARR terms, a $1.74B exit means about $125M ARR at 14x or $174M at 10x. The base case reaches $59M in 2034.

Honest probability statement

• Seed ≥30x: about 2-3%. The bull case is the only modeled path besides the 1% outlier, and at its central value it returns 28.9x, just under 30x. I credit roughly 1-2 points for the part of the bull range that ends above $1.74B, plus the 1% outlier. Seed ≥50x: about 1%.
• Pre-seed ($8M post) ≥30x: about 6% (range 4-8%). The central bull case clears $0.73B comfortably (68.6x). Credit for most of the bull range and the outlier, plus a sliver of the base case's upper tail. ≥50x: about 4-5%. At a $6M post, ≥30x is about 8%, because the upper part of the base range starts to clear $0.55B.
• Most likely: failure or a sub-preference tuck-in (~75%). A $150-500M strategic sale (~18%), consistent with the Dreadnode, Lakera, Prompt Security and Koi comps.
• For a 30-50x bar: this clears it only as a pre-seed check at $6-8M post, held through the seed with pro-rata, and only if the 12-month kill criteria in §17 are passed. As a seed investment it does not meet a 30x bar on its own model.

15. Risks and mitigations

16. Legal and regulatory checklist (factual; not legal advice, confirm with counsel)

• Authorization to test: written authorization from the system owner. For vendor-hosted bots that is the vendor, not the FI. This avoids exposure under U.S. CFAA and state equivalents and the UK Computer Misuse Act, and under vendor contracts that forbid customer-run pen tests.
• Model-provider terms: generating jailbreaks with commercial APIs can breach usage policies unless the provider has an authorized red-team program. Prefer open-weight attacker models.
• Customer data: exfiltration tests capture whatever the bot leaks, so treat Countersign as handling NPI. GLBA safeguards flow down through contracts. Offer the self-hosted runner, DPAs and data residency. Minimize and auto-redact transcripts.
• Bank vendor requirements: interagency TPRM guidance (OCC Bulletin 2023-17); SOC 2 Type II; pen-test attestation; business continuity; right-to-audit; NYDFS Part 500 vendor requirements; possible Bank Service Company Act notification exposure.
• Framework references: SR 26-2 / OCC Bulletin 2026-13 (April 2026; replaced SR 11-7; excludes gen-AI; referenced only by analogy); NIST AI RMF and GenAI Profile; FFIEC IT Examination Handbook (CAT retired August 31, 2025); NYDFS AI industry letter (October 2024); EU AI Act (Annex III December 2027 per the provisional omnibus; confirm); ISO/IEC 42001; AIUC-1 and HITRUST AI certification requirements (confirm provider-recognition terms).
• Marketing claims: do not say "compliant," "certified" or "examiner-approved." Tier 2 outputs are "indicators."
• Fair-lending testing: results are statistical risk indicators with stated power, not legal determinations.
• Data rights: contracts license only derived, non-reversible metrics for benchmarks. No raw transcripts are pooled.
• Corporate: Delaware C-corp, IP assignment from all founders, OSS license compliance (PyRIT MIT, garak Apache-2.0, Promptfoo MIT; verify current licenses), export-control screening, and E&O/cyber insurance quoted before the first paid pilot.

17. 90-day plan and kill criteria

Days 1-30

• Sign the CTO co-founder (pre-seed closing condition).
• 25 discovery calls in the vertical slice: 6 AI chatbot/contact-center vendors, 10 compliance officers at banks and CUs that use those vendors (half of them at banks with PANW or CrowdStrike entitlements), 3 regional-bank CISOs, 2 CUSOs, 2 pen-test/audit firms, 2 IT audit directors.
• Do not prompt about examiners. Count how many prospects raise "our examiner asked about AI chatbot testing" unprompted.
• Ask every vendor: "Would you accept a Countersign report in place of, or as evidence for, HITRUST AI or AIUC-1?"
• Get an E&O/cyber insurance quote. Start the SOC 2 observation window (Vanta/Drata-class tooling, $30-50k/yr, budgeted).
• Prototype: measure cost per run and per true finding on one vendor sandbox.

Days 31-60

• Exposure checks on 3 vendor sandboxes, with the vendor's written authorization.
• Tier 1 policy-as-code on 3 FIs' real fee schedules and Reg E timelines (public or provided documents), with Tier 2 precision measured on a labeled sample.
• Evidence-pack review with 2 IT audit directors and 1 former examiner (paid).
• Open conversations with AIUC, a HITRUST assessor firm and an FS-ISAC / Shared Assessments contact about a finance annex.

Days 61-90

• Convert to paid pilots. Close the pre-seed only if the gates below pass.

Kill or pivot criteria (commitments, not stated intent):

1. Fewer than 3 signed paid pilots by day 90, and fewer than 2 written LOIs that name a budget line and a fiscal year.
2. Fewer than 2 AI vendors signing paid attestation pilots, or no FI TPRM team willing to formally accept the artifact. This kills the vendor-pays model.
3. More than half of compliance and security buyers at banks with a PANW, CrowdStrike, Zscaler, Cisco, Check Point or Mindgard entitlement say it is "good enough," and the compliance function shows no separate budget.
4. Tier 2 judge precision below ~85% on design-partner data. Then conduct testing ships only as Tier 1 and is not the wedge.
5. Measured cost per true finding makes 60%+ gross margin unreachable at the planned prices.
6. Unprompted mention of examiner interest below 20% of FI calls. Then the GTM leads with vendors and fintechs only, and bank revenue in the model moves out a year.
7. No CTO-calibre co-founder signed. The pre-seed does not close.
8. 12-month criterion: no standards body (AIUC, HITRUST assessor network, Shared Assessments) and no TPRM platform references the finance suites. The standards/network thesis is then dead, and the company should be run and priced as a $40-60M ARR vertical business targeting a 5-15x outcome.

18. Domain name candidates (availability not checked)

1. countersignai.com
2. getcountersign.com
3. countersignhq.com
4. redattest.com (fallback brand)
5. tellerproof.com (fallback brand)
6. examproof.com (fallback brand)

19. Red team and response

Three reviews were run against v1: an investor/returns review, an enterprise-sales review and a CTO review. Each critique is listed with the response. Accepted means the plan or model changed. Partly accepted means the plan changed in a different way or by a different amount. Disputed means I kept the original position and give the evidence.

19.1 Investor / returns review

19.2 Enterprise sales review

19.3 CTO review

19.4 Where I push back

• "Pre-deployment attack testing will be in most big-bank enterprise licenses by 2028." Directionally right, but PANW's own documentation shows Prisma AIRS AI Red Teaming needs its own license on top of Prisma AIRS. Bundling is an ELA-credit and procurement-convenience problem, not literally free. The plan's response, which is to stop selling breadth, is the same either way.
• "Lifetime capital need becomes about $120M+." That applied v1's growth to a 1.5x burn multiple. v2 cuts growth and spend together. At an aggregate 1.49x burn multiple, base burn is $72M through breakeven, and the 2.0x stress is $86M through 2033. The $106M raise covers the stress case. The reviewer's direction (more capital, more dilution, a C round) is accepted. The exact figure is not.
• "Seed 30x threshold rises to about $1.9B." On v2's actual round structure it is $1.74B with a Series C. It is $2.2B if the A, B and C price at about 20x ARR. Both figures are reported. Neither changes the conclusion.
• Pre-seed odds of "about 10%" at a $6-8M post. v2 is more conservative: about 8% at $6M and 6% at $8M, because v2's base case is smaller than v1's.
• AIUC "KPMG certified in Aug 2026." I confirmed KPMG among AIUC-1 certified companies named in the September 2026 Series A coverage. I did not confirm the August date.

19.5 What the red team did not change

• The base-case shape: about 75% of outcomes are failure or a sub-preference tuck-in, and the most likely success is a $150-500M strategic sale. All three reviews agreed with v1 on this, and v2's numbers reinforce it.
• The integrity position: no customers, partners, LOIs or traction are claimed, and none are implied by the vertical-slice design-partner list.

Sources are cited inline. Figures marked "reported," "estimated," "not independently verified" or "unmeasured" could not be confirmed from primary sources or have not yet been measured. All financials are projections from model.json (v2), built by model_build.py. v1 files are in ./v1/.