Cybersecurity — What's Going On (May 2026)

The Short Version

Cybersecurity is a tough space for a solo founder to break into. The overall market is huge — $272 billion in 2025 — but it's dominated by big, trusted companies. The core problem: when it comes to security, buyers don't want to hand over access to an unknown, one-person company. The few paths that could work for a solo founder are: security-awareness training for small businesses (priced below what the market leader, KnowBe4, charges), tools built for developers (like scanning for leaked passwords, or a pre-launch security checklist), and helping very small startups get "SOC 2" ready (a security checklist companies must pass before they can sell to bigger customers) without paying enterprise prices. All three already have real competition.

How Big Is This, Really?

• Grand View Research says cybersecurity is worth $271.88 billion in 2025, growing to $663.24 billion by 2033 — about 12% bigger every year
• MarketsandMarkets' numbers land in the same range, confirming the estimate

Who actually pays, and who a solo founder could actually reach

The best customer for a solo founder: an early-stage startup that needs to prove basic security ("SOC 2 readiness") to close their first big sale, or an independent developer who wants a tool that scans their code for leaked passwords, right inside GitHub. Both of these let you get customers by just putting your product online, without a sales team.

The Real Problems People Have

Small businesses can't afford security training

• A common post on Reddit's r/sysadmin and r/msp: "KnowBe4 is overkill at $25 per person per year for my 20-person team"
• Businesses with 10–50 employees need to teach their staff to spot fake emails (phishing), but can't justify a $500–2,000-a-year contract
• The real problem behind this: according to Verizon's yearly security report, someone clicks a fake email link every 36 seconds — small businesses know this is a risk but can't afford to do anything about it

Developers accidentally leak passwords online

• A common post on r/netsec and Hacker News: "I accidentally committed my AWS key to GitHub"
• GitGuardian offers a free plan for public code, but charges $29+/month for private code
• Infisical is a popular free tool for managing secret passwords, but you have to run it yourself
• This is a real, growing problem — leaked passwords cause real security incidents, and more developers are becoming aware of it after several high-profile leaks at GitHub and AWS

Small startups can't afford to prove they're secure

• A common post on r/startups: "We need SOC 2 to close our first enterprise deal but Vanta is $7,500/year"
• Vanta ($7,500–$15,000+/year) and Drata ($6,000–$20,000+/year) are priced for companies that have already raised real funding
• Nobody has built an affordable ($99–299/month) tool that helps a 1–10 person team track what they need for basic security readiness

Who Else Is Already Doing This

Security-awareness training for small businesses

• KnowBe4 — the market leader, $25–50 per person per year (usually a $500–1,000 minimum), with an aggressive sales team
• Proofpoint Security Awareness Training — built for big companies
• Cofense — built for big companies
• Curricula (now owned by Proofpoint) — friendlier to small businesses, about $10 per person per year
• Hoxhunt — game-like training, about $10–15 per person per year
• The gap: a flat $29/month tool for companies under 30 people, simple enough to just swipe a card and go — no per-person math

Developer tools that scan for leaked passwords

• GitGuardian — free for public code, $29+/month for private, already well-known on GitHub
• TruffleHog — a free tool you run yourself
• Infisical — free if you run it yourself, or $0–50/month hosted for you
• Doppler — a paid tool for managing secret passwords, $10–99/month
• Verdict: crowded, with strong free options — hard to charge money here

Helping startups pass security checklists

• Vanta — $7,500–$15,000+/year, well-funded and well-known
• Drata — $6,000–$20,000+/year
• Scytale — similar pricing to Vanta and Drata
• Sprinto — based in India, slightly cheaper (about $5,000/year)
• Secureframe — $2,000–$8,000/year
• The gap: a $99–299/month tier for startups that haven't raised much money yet and just want a checklist, not full automation

What You Could Actually Build

BEST BET (but still hard) — A lightweight security checklist for very early startups

• The problem: paying $6,000–15,000 a year for Vanta is way too much for a 3-person team that just needs to pass security review for one deal
• Who would pay: very early-stage startup founders who are being asked security questions by a bigger company they're trying to sell to
• What to build: a guided checklist covering the 50 key security items, with a simple yes/no/proof system and a report showing what's missing
• Price: $99–199/month
• The risk: Vanta and Drata will likely build cheaper versions eventually, and trust is hard for an unknown company to earn
• How to find customers: Y Combinator's community, founder forums, r/startups
• Verdict: Niche — real buyer, real gap at $99–199/month, but Vanta is training the whole market to expect full automation, not just a checklist

Fake-email training for small businesses

• The problem: companies with 10–50 employees need training but can't afford KnowBe4
• Who would pay: small business owners and general IT staff, at a flat $29/month
• The risk: you'd have to constantly write new fake-email examples to stay useful, trust is hard to build, and Curricula/Hoxhunt already offer something similar for about $10 per person
• Verdict: Niche — real problem, real competition, and a real trust gap to overcome

A security checklist for developers launching something new

• The problem: solo founders launching a first version of their product have no basic security checklist to follow
• Who would pay: almost nobody — independent developers expect this kind of tool to be free
• Verdict: Vitamin (nice to have, but not something people feel they truly need) — useful, but very hard to charge money for

The Bottom Line

Cybersecurity is the hardest category for a solo founder to break into. The trust problem is real: companies won't hand over visibility into their security to an unknown, one-person vendor. The only paths that could work are either (a) tools built for developers, where your code itself proves you're trustworthy, or (b) helping companies get ready for a security checklist without actually being responsible for their real-world security. Even those two paths already have real competition.

If you're set on cybersecurity: a $99/month security-readiness checklist for very early startups is the best bet. The existing tools ($6,000–15,000/year) are genuinely too expensive for the earliest companies. But you'll need to build a lot of trust within founder communities to get anyone to sign up.

Where These Numbers Come From

The market-size and security-incident figures below come from named reports. Everyday details — competitor prices and what people are saying on Reddit — come from general research knowledge rather than one single report.

• Grand View Research — Cybersecurity: $271.88B (2025) → $663.24B (2033); 11.9% yearly growth
• MarketsandMarkets — Cybersecurity Market (cross-check, same range)
• Verizon Data Breach Investigations Report 2024 — phishing click-rate data