The tools handed people the work. They needed the work done.
CMMC tooling was stuck in 2010: checklists, and software that needed an expert to use it. 110 controls, 320 assessment objectives, and defense manufacturers with no security staff.
- Started with the competition. Vanta’s interface is its data model: everything bolted on, nothing specialized or guided. Delve promised agentic evidence gathering the benchmarks said wasn’t ready. Conway’s law applies: a product mirrors the org that built it. Vanta, Delve, Conway’s law
- Bet against browser agents. In 2025 the best computer-use agent finished 38% of the desktop tasks people finish 72% of, slowly and at real cost. That’s on a benchmark, where scores get optimized; real customer environments are worse. Evidence an auditor will test can’t work that way, so GARDE1 collects it directly. OpenAI, 38.1%, OSWorld, 72.36% for people, tens of minutes per task, cost and benchmark overfitting
- Turned 27+ menu items into states. Ease of use is the product, so the interface follows where you are in the work, not what the software contains.
- Built all of it. Thesis, brand, design, marketing and engineering. 8,731 commits across a .NET agent, a Go backend and a TypeScript frontend.
A mock CMMC assessment that runs end to end, and three inventions inside it. Two are patent pending.
Sources: CMMC, 110 controls, 320 assessment objectives (NIST SP 800-171A)