The Security Evidence Layer for AI-Built Software

AI has made software faster to build. It has also made software harder to trust.

That is the founder problem Verglos is built around.

The question is no longer only:

Can we build this?

With AI, the answer is increasingly yes.

The harder question is:

Can we prove this is safe enough to ship, sell, or hand over?

That is where most security tools miss the business moment.

They find problems. They create dashboards. They generate alerts. They help developers improve code quality.

But the buyer often needs something else:

Evidence.

A founder needs evidence for procurement. An agency needs evidence for client handoff. A startup needs evidence for diligence. A consultant needs evidence that the AI-assisted codebase was checked before delivery.

That is the category Verglos should own:

Verglos is the security evidence layer for AI-built software.

The Scanner Is Not The Product

This is the most important business decision.

The scan should be free.

Not partially free. Not "pay to see file paths." Not "unlock to see line numbers." Free means the user gets the score, findings, paths, line numbers, local HTML report, and JSON output.

Why?

Because scanning is already commoditized.

Developers have GitHub, Snyk, Semgrep, Socket, Gitleaks, TruffleHog, npm audit, OSV, and many other tools. Some are free. Some are bundled. Some are enterprise-grade.

If Verglos hides findings behind a paywall, it looks hostile.

If Verglos gives away the full scan, it earns trust and distribution.

The scan is marketing.

The product is what happens after the scan:

• signed attestations
• public verify URLs
• white-label client reports
• SBOM exports
• evidence archives
• score history
• remediation history
• secret rotation logs
• compliance-ready summaries

That is what a business pays for.

Why AI-Built Software Needs Evidence

AI-assisted development has a trust gap.

A human team can say:

We followed our normal engineering process.

An AI-assisted team often has a harder time saying that, because the process is newer, faster, and less legible.

The client knows the agency used AI. The founder knows contractors shipped quickly. The enterprise buyer knows the prototype was built fast. The investor suspects the product is held together by generated code.

That does not mean the code is bad.

It means trust needs proof.

The proof should answer:

• How much of this code appears AI-authored?
• Where are the risky areas?
• Were secrets checked?
• Were dependencies checked?
• Were obvious AI-generated failure modes checked?
• Were critical and high findings resolved?
• Can this report be verified later?

That is not a generic developer scanner workflow.

That is an evidence workflow.

The Research Signal

Verglos ran a scan campaign across 300 public repositories.

294 scans completed successfully.

Across those 294 scans:

• 45.6% had at least one critical or high finding
• 24.8% had at least one critical finding
• 36.4% had at least one high finding
• 71 repos scored below 70
• 16 repos scored 0

The campaign reported:

• 395 critical findings
• 1,195 high findings
• 3,076 medium findings

The most common serious patterns were familiar and commercially important:

• SQL injection
• exposed secrets
• private keys in code
• secrets in git history
• weak token generation
• wildcard CORS
• stack trace leaks
• missing ownership checks
• mass assignment
• suspicious or non-existent packages

This is the validation:

The risk is common enough that "just trust the generated code" is not a serious operating model.

Founders and agencies need a fast, repeatable proof step.

Why Agencies Are The Sharpest Buyer

Agencies are the clearest early customer because they face a recurring gate: client handoff.

Every project ends with a moment where the client asks:

Is this ready?

For traditional agencies, that question used to mean design, functionality, deployment, and documentation.

For AI-assisted agencies, it now also means:

Did you check the generated code?

The agency may have used Cursor. The contractors may have used Claude Code. The repo may contain agent artifacts, generated configs, and AI-shaped code. The client may not know how to evaluate any of that.

A Verglos handoff report gives the agency a concrete answer:

• Here is the score.
• Here are the findings.
• Here are the critical issues fixed before delivery.
• Here are remaining lower-severity notes.
• Here is the AI-provenance breakdown.
• Here is the signed report.
• Here is the verification link.

That is not a developer feature. That is a business feature.

It helps the agency close the project cleanly.

Why Founders Are The Second Buyer

Founders face a different gate: trust from outsiders.

That might come from:

• an enterprise buyer
• a pilot customer
• an investor
• a technical advisor
• an acquisition diligence process
• a partner integration review

At some point, a serious buyer asks:

What is your security posture?

Early-stage founders usually do not have SOC 2. They may not have a full-time security engineer. They may not even have a complete internal engineering team.

Verglos does not replace SOC 2. It should not claim to.

But Verglos can provide something useful before SOC 2:

A dated, verifiable security posture artifact focused on AI-built software risk.

That is valuable because it gives the founder a serious answer instead of hand-waving.

The answer becomes:

We ran Verglos on this codebase, resolved critical findings, produced an SBOM, archived the report, and can share the verification link.

That does not solve every security requirement. But it is much better than saying, "Our developers said it is fine."

Why Developers Still Matter

The buyer may be a founder or agency owner, but the user is still a developer.

That means the product cannot be fluffy.

The developer needs:

• accurate file paths
• line numbers
• useful snippets
• clear fixes
• JSON output
• CI support
• pre-commit support
• MCP integration
• low false-positive noise
• local-first execution

This is why the free scanner matters. If developers do not trust the output, the business artifact has no value.

The report must be useful even when Verglos has no brand equity.

On day one, nobody buys the badge because the badge is famous. They buy the report because the report is useful.

The badge gains meaning over time.

What The Attestation Should Include

The attestation is the business product.

A strong verglos attest output should include:

• project name
• client name, if applicable
• scan date and time
• Verglos version
• commit hash
• score
• severity counts
• critical/high findings
• resolved findings
• remaining risk
• AI-provenance summary
• SBOM
• dependency risk summary
• secret scan summary
• git-history secret summary
• signature hash
• public verify URL

The public verify page should answer one question:

Is this report real, unchanged, and tied to this project state?

For agencies, it becomes a handoff artifact.

For founders, it becomes a diligence artifact.

For Verglos, it becomes the business.

Why This Is Better Than Fear-Based Monetization

A tempting scanner business model is:

We found problems. Pay to see them.

That is a bad idea.

It creates distrust. It makes the company look like it is monetizing fear. It also fights against the existing market, where many tools already show findings for free.

Verglos should do the opposite.

Show everything.

Then charge for:

• proof
• history
• sharing
• verification
• remediation workflow
• client-facing presentation
• compliance packaging

That is a cleaner business.

The user gets value immediately. The paid product exists when there is a business gate.

The Pricing Logic

The strongest tier ladder is:

• Free: full unlocked scan
• Pro: CI, monitoring, fixes, serious solo/team usage
• Studio: agency handoff reports, attestation, white-label, rotation
• Compliance: founder procurement, evidence archive, SOC 2 readiness, posture PDF
• Platform: embedded engine and MCP for AI coding platforms

This works because each tier maps to a stronger gate.

Free has no gate. It drives adoption.

Pro has a discipline gate. Serious builders pay to keep scans in CI.

Studio has a client handoff gate. Agencies pay because every client project creates the need.

Compliance has a procurement gate. Founders pay because buyer trust blocks revenue.

Platform has a distribution gate. AI coding platforms pay if their users need embedded trust.

That is the correct ladder.

The Category Sentence

Verglos should repeat one sentence everywhere:

Verglos is the security evidence layer for AI-built software.

Supporting messages:

• The scan is free. The evidence is the product.
• AI code is leverage. Verglos makes it accountable.
• Turn AI-generated code into client-ready security evidence.
• Scan the code. Prove the handoff.
• Know what AI wrote, what it got wrong, and what was fixed.

This is stronger than "AI security scanner" because it connects to the business event.

Final Takeaway

AI-generated software is becoming normal.

The trust process around it is not.

That gap is the opportunity.

Founders and agencies do not need another dashboard full of alerts. They need a repeatable way to prove that fast-built software was checked before it reached customers, clients, or procurement.

That is the business case for Verglos.

Not another scanner.

The evidence layer.