GARDE1

Small and mid-sized manufacturers in the US defense supply chain have to pass CMMC, the hardest cybersecurity standard in the country, to keep their contracts. Most have no security staff and no budget for consultants. The tools built for them hand untrained people expert work.

GARDE1 does the work for them: one guided line through the whole assessment, on an engine that can’t fake the answer. It runs a mock CMMC assessment so a company finds its gaps before paying for the real one.

I built all of it: the thesis, the brand, the product, the marketing site and the engineering.

Where it started

GARDE1 started as competitive analysis. CMMC tooling was stuck in 2010: checklists, and GRC platforms that still needed a person who already understood a behemoth of a standard. At Level 2 that’s 110 controls and 320 assessment objectives. Most tools fell short exactly there.

AI made it the right time to build a GRC that does the work, and CMMC is the standard that needs one most. So I studied the incumbents first. My read:

• Vanta’s interface is its data model. Everything is a bolt-on; nothing is specialized or guided for the job in front of you.
• Conway’s law applies. A product mirrors the organization that built it, and a new coat of paint doesn’t change the org chart.
• Delve sold agentic evidence gathering. In our evaluation, well before the whistle blew, it came with an RPO, a human consultant, attached. We expected that. (In 2026 Delve was publicly accused of fabricating compliance evidence, which it denies.) When we started in 2025, the best computer-use agent finished 38.1% of OSWorld’s desktop tasks, where people finish 72.36%. On realistic web tasks, agents had started from 14.41% against 78.24% for humans. Those are benchmark scores, and benchmarks get optimized for; a customer’s real environment doesn’t. Real-world performance is worse than the leaderboard. And every step an agent takes is another screenshot for a model to read: tens of minutes for tasks that take a person a few, expensive, and one more thing to supervise. Evidence an auditor will test can’t be gathered that way, so GARDE1 collects it directly, through connectors and an endpoint agent.
• Drata redesigned its experience to cut friction across the same sprawl.

The lesson for GARDE1: design the product around the work, not the database or the org chart.

Strategy

Start with the hardest standard. If the engine can pass CMMC, the rest is commercialization. The same engine now covers SOC 2, with GDPR next. The rigor is the wedge; the broader market is the business.

Product and brand

The thesis on the product side is that the customer should never need to understand assessments, frameworks or scoring. Ease of use is the product. I designed the brand, the interface and the guided flow around that one rule.

That’s why the 27+ items in a typical GRC’s left nav became the states of a GRC in ours: the interface follows where you are in the work, not what the software contains.

Engineering

8,731 commits across three codebases between May 2025 and September 2026: a C#/.NET endpoint agent, a Go backend for evaluation, evidence and document generation, and a TypeScript frontend and connector runtime.

Two pieces are new enough to patent:

• PWTL, the task language behind every judgment the platform makes. Patent pending.
• The document system. A compliance document has to be defensible: every statement traceable to a fact, no invented controls, and stable enough that two runs don’t produce two different policies. GARDE1’s documents can explain why each statement in them is there. Patent pending.

Where it is

Scope, documents and evidence are built and wired, and the mock assessment runs. The work now is proving the evaluation trustworthy end to end, because that, not the number of features, is what decides whether the product is good.