Stop Pitching the Product, Start Proving It: Introducing the SITG Founder Programme
Founders building in post-quantum cryptography, AI and trust technology rarely lose a deal at the demo. They lose it later, at the evidence. The product works, the engineering is sound, and then a bank, insurer or government buyer asks a question the company cannot answer with proof.
For eight years SITG-Consulting has worked with founders on that problem case by case, alongside our work for banks, regulators and critical infrastructure operators. The same two questions arrive every time: "We have built something. Can we prove it?" and "We have built something. How do we make the case?"
The SITG Founder Programme formalises that work into two services, each with its own scope, its own deliverables and a deliberate wall between them: the SITG Founder Product Review and SITG Startup Advisory.
Why founder deals stall at the evidence, not the demo
A regulated buyer purchasing from a startup is accepting risk it will later have to defend to its board, its auditors and its regulator. The demo shows that the product works. The questions that follow ask whether the company can be relied on. In our experience, founder deals stall at five recurring points.
The questionnaire. A security or vendor due diligence questionnaire comes back with answers the founder cannot evidence.
The standard. A standard is claimed but not evidenced. "FIPS compliant" is not the same as using a module that holds a FIPS 140-3 validation certificate, which a buyer can check on NIST's Cryptographic Module Validation Program list.
The inventory. The buyer asks for a cryptographic bill of materials, a record of every algorithm, key and certificate in the product, and none exists.
The deck. Investor technical due diligence finds claims the deck cannot support.
The owner. Nobody is named as accountable for keys, model changes or third-party components.
None of these is an engineering failure. Each is a failure to build the evidence and governance around a product that may be entirely sound.
Financial services: where the bar sits highest
Payments, digital identity, fraud and anti-money laundering models, key management, digital asset custody and regulatory technology are some of the largest markets open to founders in this space. They are also where the buyer's obligations are heaviest, because a bank that buys from a startup takes on third-party risk it must manage and evidence.
In the European Union, the Digital Operational Resilience Act sets requirements for how financial entities manage risk from their technology providers, including exit strategies for services that support critical or important functions.
In the United Kingdom, the Prudential Regulation Authority's supervisory statement on outsourcing and third party risk management sets expectations for due diligence, access and audit rights, and business continuity, applied in proportion to how material the arrangement is.
In Malaysia, Bank Negara Malaysia's Risk Management in Technology policy document sets technology risk requirements for financial institutions, including the management of third-party service providers.
These obligations sit with the bank, not the supplier. The bank owns its due diligence and its exit strategy. It cannot meet either without the supplier's cooperation: access to and portability of its data, evidence of resilience testing, incident reporting, audit rights, and a credible account of the product's cryptography. Cryptographic lifecycle and post-quantum readiness add a further layer of scrutiny on top. The buyer needs defensible answers before it can approve the risk.
Claimed versus evidenced: language that survives due diligence
The same product can be described in two ways. Only one of them survives a procurement committee.
"Quantum-safe" becomes "uses ML-KEM-768, standardised in NIST FIPS 203, for key establishment in the TLS layer."
"FIPS compliant" becomes "uses a FIPS 140-3 validated module, with the certificate number stated."
"AI-governed" becomes "model changes are approved by a named owner, logged and reversible."
"Enterprise-ready" becomes "security questionnaire library complete, controls mapped, support model named."
The evidenced version is longer and less exciting. It is also the version a risk committee can sign off.
Service one: the SITG Founder Product Review
The SITG Founder Product Review is an independent, point-in-time validation of what a product claims. It examines six categories of claim: technical, security, governance, compliance, operational and resilience.
It is offered in three bands, Essential, Enhanced and Full Validation, calibrated to the founder's stage and the evidential standard the buyer will expect. Every engagement produces a verdict: Validated, Conditional or Not Validated. Where a cryptographic assessment framework is needed, it draws on the Quantum Cryptographic Assurance Standard (QCAS), SITG-Consulting's own proprietary standard.
The result is a scoped finding a bank's risk committee, an investor or a procurement team can assess on its evidence. It is not a certification, not a FIPS 140-3 validation and not a penetration test.
Service two: SITG Startup Advisory
SITG Startup Advisory is a retained engagement that builds the commercial and governance case around a product. It runs across six workstreams, deployed according to the founder's stage, market and next commercial event.
Business case and funding narrative: a case grounded in regulatory mandate and procurement evidence rather than projections.
Investor deck and technical diligence pack: claims stated at the level the evidence supports, with gaps disclosed as a dated remediation plan.
Procurement readiness: a security and vendor due diligence questionnaire library with the evidence attached.
Regulatory mapping: alignment to the standards and schemes of the buyer's jurisdiction first, not the founder's assumption.
Governance and lifecycle design: crypto-agility, key and entropy provenance, AI model lifecycle and third-party component governance.
Positioning and content: thought leadership published in the founder's own name.
An early-stage company may need only the business case and positioning. A Series B company entering bank procurement may need all six.
Advisory and validation are separate by design
Offering both services creates an obvious risk: a firm validating claims it helped write. Three rules prevent it.
Origin. SITG-Consulting never validates a claim it authored. Product claims originate with the founder.
Purpose. A validation finding is evidence. An advisory deliverable is argument. Each serves a different reader.
Firewall. Where a founder holds both services, the validation team does not see advisory output during the review.
A founder can hold either service, or both. Neither depends on the other.
Independence by structure
Advice and validation are only commercially valuable when the adviser has nothing to gain from the answer. SITG-Consulting holds no product vendor partnerships, takes no equity stakes, charges no success fees and gives no investment advice or financial projections. The engagement fee is the only fee.
Four questions to answer before your next raise or bank tender
Could you hand a bank your cryptographic bill of materials tomorrow?
Can you evidence every standards claim in your deck, and name the certificate wherever you claim validation?
Could a bank exit your service without losing access to its data or disrupting critical operations?
Who in your company owns the keys, the model changes and the suppliers?
If any answer made you hesitate, that hesitation is where the deal stalls.
Frequently asked questions
What is the difference between the Founder Product Review and Startup Advisory?
The Founder Product Review tests what a product claims and issues a verdict. Startup Advisory builds the commercial and governance case around the product on an ongoing basis. One examines; the other prepares.
Can a founder use both services?
Yes. The firewall described above applies: claims remain the founder's, and the validation team does not see advisory work during a review.
Is the Founder Product Review a certification?
No. It is an independent, evidence-led assessment of a specific product version at a point in time. It is not a FIPS 140-3 validation, a formal certification or a penetration test.
Which founders is the programme for?
Founders building security, cryptography, post-quantum, AI-risk, trust and governance products for buyers that operate under regulatory obligation, with financial services, government and critical infrastructure the primary markets.
Do you take equity or success fees?
No. The engagement fee is the only fee.
Related reading
The Lexicon: plain definitions of the terms used in this post
Start with the case you need to make
If a raise, a tender or a regulator meeting is coming, the case needs to exist before the question arrives. Book an initial discussion through the Startup Advisory or Founder Product Review pages, or write to brian.couzens@sitg-consulting.com.
Comments