Roadmap

The phased plan, the live shot pipeline (deals, grants, programmes, events), and the dated execution timelines — combined. Strategy and the flywheel live in Strategy.

12-month milestone ribbon

Q3 2026 (Jul–Sep) is a locked product-development block. Grant pursuit and most external pushes sit before or after it; the demo-ready gate on 2026-09-30 is the hinge for everything in Q4.

timeline
  title Critical Milestones (2026 Jun → 2027 Q1)
  2026 Jun : Company Formation : Positioning & deck : TIG ecosystem mapping : CISSP exam (Jun 16)
  2026 Q3 (locked) : Product dev sprint : AI Verify accreditation opens : RSAC SG / CyberSG Innovation Day
  2026 Q4 : Product demo-ready gate (Sep 30) : FI LOIs + CSA CyberCall : Apart fellowship application
  2027 Q1 : FSTI 4.0 prep : Google Accelerator cohort : Apart fellowship cohort

Personal / founder credential tracks (FRM, CMU MSIT, GDE, OWASP-PR) are not on this ribbon by design — CISSP is the only credential on the company critical path. The founder’s individual credential + growth timeline lives in Founder Credentials & Growth.

Also tracked: SPS / research fellowship application (work sample: harness engineering, gctrl, pentest + smart-contract) and academic workshop tracks (DLS, RAIID, agent-based AI) via the OSS → arXiv preprint → workshop pipeline.

Shots

The live pipeline — concrete attempts we’re actively taking against the opportunities: pitches, deals, grant submissions, programme applications. The execution timelines below are the dated view of these same shots.

GTM playbook — pitch as critical enterprise infrastructure, not “an AI startup.” Get embedded in the cybersecurity network via ICE71 and land a design partner (an enterprise willing to test the secure layer on their systems, even unpaid). Then use that design partner to apply for CSA CyberCall (up to S$1M) or Startup SG Tech (S$400k POC / S$800k POV) to fund the heavy backend engineering — and run through the IMDA GenAI Sandbox to come out “regulatory-assured.”

Grants

Non-dilutive funding. Detailed timing is in the fundraising timeline below; the funding model (revenue sharing) is in Strategy · Fundraising.

Default to non-dilutive — via non-equity partners, not first-time-founder schemes. Startup SG Founder / its Accredited Mentor Partners (AMPs) are first-time-founder only → out for us. Go non-dilutive through partners who take zero equity instead: an enterprise theme-owner for CSA CyberCall, an FI lead applicant for MAS FSTI, or a grant consultant on a success-fee (not equity). Every grant below is open to experienced founders — no first-time-founder gate — unlike equity accelerators such as Antler.

Runway note: no grant revenue before ~Q1 2027; the Q3 2026 dev block needs a bridge — angel, income-sharing revenue, or a fast EDB-style grant outside FSTI.

Programmes and accelerators

Credibility, network, and distribution.

Events and pitch stages

Where we pitch, network, and get found.

Leadgen ICP at conferences — work the conference plus its side events and hackathons to find two buyer types: founders who need technical heavy-lifting (FDE delivery), and finance founders who need AI-native tools (Contextful / Meerkat).

Ecosystem presence — AI safety

Visibility and collaboration in Singapore’s AI-safety ecosystem — tight-knit and driven by public-private partnerships. Anchoring here is the “regulatory-assured” credibility moat behind the GTM: contribute into the institutions that set the assurance bar, so we’re a known quantity to the gatekeepers (and to government reference-customer demand) before the Q4 window. This overlaps the Programmes shots (AI Verify accreditation, IMDA GenAI Sandbox / Spark) and the network map — but this is the contribute-code-and-research angle, not just enrolment.

Action — partnership exploration (sovereign-AI wedge). Open conversations with domain experts and the associations above to co-position as the AI-safety / sovereign-AI assurance authority. The wedge is concrete: Singapore’s National Multimodal LLM Programme (S$70M; IMDA + AI Singapore + A*STAR) and the open SEA-LION models mean there’s a sovereign stack that still needs independent red-teaming and assurance — exactly our lane. First moves: (1) publish a SEA-LION red-team / eval (mirrors the IMDA × Humane Intelligence challenge) as the calling-card artefact; (2) pair our security / eval depth with one domain expert per priority vertical (health, finance, gov) so the association’s stage carries distribution. Outcome to track: ≥1 co-authored artefact or co-run session per quarter that names us as the safety / sovereignty expert.

Execution timelines

Edit the ```mermaid gantt blocks below directly — they render natively in Obsidian and as interactive charts on the site. crit marks hard dates (exams, deadlines, gates).

1. Hackathons & programmes

2. Fundraising

Runway risk: no grant revenue until earliest Q1 2027 — the Q3 dev block needs a bridge (angel, revenue, or a fast EDB-style grant outside FSTI).

3. Product launches

Two flagship products anchor the launch (see Strategy · Flagship products):

• Contextful — local-first agent context & memory, built on the Hakiri context engine + ETL pipelines (the data-flywheel moat, productized).
• Meerkat — guardrails/auditing for agents in finance & compliance (the governance/control-plane moat, productized).

Both are built inside the Q3 dev block and launch into the Q4 demo + grant window. The lead wedge (security-assessment + compliance-readiness engagement) is the FDE entry motion; the flagships are the systems those engagements deploy and expand on.

4. Credentials on the company critical path

On the critical path: CISSP only. It’s load-bearing for fractional-CISO trust and the exam is imminent (Jun 16). Every other credential track (FRM, CMU, GDE, OWASP-PR) is a personal / brand track deferred off the committed 7-month window — it must not compete with selling and the Q3 build for founder hours. To an investor or buyer, a multi-track credential Gantt signals “the founder is the deliverable”; those tracks live on the founder’s own roadmap, not this company one.

The full individual credential + growth timeline — CISSP alongside OWASP-PR, FRM I/II, CMU MSIT Privacy Eng, and GDE, with all the hard dates — is tracked separately in Founder Credentials & Growth. The commercial triage of which credentials are load-bearing vs. background is in Expertise · Credentials.