R1-06 Market sizing

Supports slide 9.

Bottom-up: who must comply, and who our partners can reach.

Layer	Size	How I got it
TAM	$6.5B (2025), $10.9B by 2031	Verdantix, GRC software market, 22 Jul 2026
SAM	About $153M	76,598 defense industrial base entities needing CMMC Level 2 × $2,000 ACV
SOM	About $1.8M	About 900 partner-reachable accounts × $2,000 ACV

The SOM, built from partners

Partner	Reachable accounts
Strike Graph	357 organisations
Policycode	148
Sentient	380
DTA	Not yet counted
Total	885 counted; about 900 with DTA

The Strike Graph embed sits inside the SOM. It isn’t extra market; it’s the first route into it.

The $2,000 ACV

From the Sprint 12 unit economics pack: LTV is $5,400 at $2,000 ACV × 90% gross margin × 3 years. It’s a planning price, not an observed average. The two organisations that pay us directly pay $375 a quarter and $875 (R2-05).

What would change these numbers

• SAM. The 76,598 rests on CMMC Level 2 certification. Phase 2 third-party assessment is suspended (R1-10). The obligation under it, NIST SP 800-171 through DFARS 7012, is still in force, so I keep the entity count. A smaller SAM would be the honest reading if Phase 2 never returns.
• SOM. Partner reach is their number, not ours. Partner-sourced accounts so far: zero.

Sources

• Verdantix, Market Size And Forecast: Governance, Risk & Compliance Software 2025-2031 (Global), and the press release “Geopolitical Shocks And AI Risks Push GRC Software Market Towards $11 Billion”: verdantix.com.
• DoD Regulatory Impact Analysis for the CMMC program rule, 32 CFR Part 170: 76,598 entities requiring Level 2 certification, via the Defense Compliance Report tracker, Oct 2026.
• R2-03 partner bench register; Founder Operating System, 17 Aug 2026 (Policycode 148, Sentient 380).
• Sprint 12 Unit Economics Data Pack (project doc).