$2k in the Bank and Zero Revenue

This week we launched Pigeon Labs. Here's where we're starting from, and I'll post these numbers every month so you can hold us to them.

Hopefully the first of many launches our company will do. Our goal is simple. Bring high quality pentests to customers. And in the process, hopefully build a sliver of the culture of the pentest teams I worked on at my previous jobs. We don't have any investors, and I don't think we will raise any money. The point of this letter is for our customers, friends, and hopefully future employees to be "our investors." They will be the people who keep us accountable, give feedback on our direction if we ever aren't doing right by our customers, and lend a hand when we need it. If you are reading this, then YOU are officially part of that group.

Lots of folks ask me what the plan is. The real answer is I'm not sure…. That's because we are still trying to figure things out. But here is how we are thinking about things.

Our Model

We are starting as a services company. Why? Three reason:

1. Services are uncool. They're one-time payments with bad margins, and everyone assumes services can't scale. Everyone else is building and buying SaaS agentic pentest platforms, but those still require YOU, the customer, to manage the platform yourself. You still have to triage LLM SLOP. The reality is that when you buy an agentic pentest platform, what you are really buying is work for your security engineers, who now have to triage findings. We don't want to do that to you. We want to hand you a pentest report with only actionable items, and we'll even fix the vulnerabilities for you. That takes us to our second reason.

2. The services model allows us to actually solve the problem for our customers. Selling a service means selling the solution. We will pentest your application and fix your vulnerabilities. It also lets us provide white glove service and work really closely with our customers (we're even willing to fly out to you).

3. We need money to survive. NYC is a great place to live, but rent is expensive. SaaS brings the sweet, sweet recurring revenue model, but services help a business with cash flow. Right now we need cash flow, and services let us get it.

How we provide those services is entirely up to us, and that's the beauty of it. We are building pentest agents. We are working to reduce the time it takes to deliver a pentest and the cost of finding and fixing a vulnerability, while still getting to charge services like prices. Compare that to SaaS, which typically has a lower upfront cost but better margins.

SaaS margins are typically 85-90%, while services businesses usually sit around 30-40%. Our goal is to use agents to improve the quality, speed, and cost of delivering a pentest to the point where we can hit a 60-70% margin on a services business, getting closer to the margins of a SaaS company. So why not just build a SaaS product? Honestly, because finding product market fit and a real wedge is incredibly hard, and services let us get paid while we figure out what customers actually want.

Our GTM Strategy

Pigeon Labs isn't lacking in technical talent. We are two ex-Amazon engineers who have also worked at other big tech and Fortune 500 companies. Now GTM, err … this is where we are struggling, mostly due to our lack of experience in sales and marketing. It's also a hugely important part of Pigeon Labs, and something we as founders need to figure out ourselves. While it's always tempting to outsource, these are two functions we will not outsource. In services, getting customers (sales and marketing) and delivering the product (engineering) are the two most important parts of the business. They are the core business. Every other function (for now) is extra.

I have been asking myself how to get customers (and reading various books). At its core it's very simple. More folks have to know about our stuff. The more people who know about your stuff, the more chances you get to offer them something and, ideally, close a deal. More specifically, folks who need pentests. The strategies we know for doing that are 1) cold email/DM outreach, 2) affiliate marketing and partnerships, 3) content marketing, and 4) warm outreach. Our focus for now will be content marketing (blogs, LinkedIn, etc.) and warm outreach, while still making time for cold outbound and partnerships where we have a strategic advantage.

I don't really have any social media other than LinkedIn, so we will be building our following from zero. As a matter of fact, I find social media cringe. If we succeed, this might be a good case study on how to go from zero to mediocre influencer. The goal isn't to grow a following of random people. The goal is to grow a following of people with cybersecurity backgrounds, or tech folks who need pentesting.

More important is our warm outreach. Pigeon Labs has no brand yet. David and I are the brand. It's our reputation, our past work, and our relationships with friends and colleagues. We are counting on our network to help us build this into a company that folks are proud to be associated with. We are asking folks in our network to introduce us to CISOs, friends of friends working at cool companies, or anyone who needs pentesting. No intro is too small.

Our Moat (GTM Part 2)

"'I fear not the man who has practiced 10,000 kicks once, but I fear the man who has practiced one kick 10,000 times.' - Bruce Lee"
- Daniel Chalco

We have training and capabilities in everything from pentesting agents, to websites, to networks. And while we can do it all (we'll take any job that pays rent this year), we want to be known, and where all our marketing goes, is hacking AI agents in regulated fields. Think agents in healthcare, finance, or anywhere human safety is on the line. Pigeon Labs will be the specialist in hacking agentic systems in heavily regulated spaces.

Now the pushback might be that this isn't a big enough differentiator…. True tbh. There are probably thousands of pentest services companies out there, including agentic ones you've heard of like XBOW and Armadin. I am a big fan of a lot of them too like Cure53 and Trail of Bits. Honestly, most of them aren't that different from each other, and right now that includes us. Our bet is that going deep on one kind of system makes us better at it than the generalists, and that specialists are who people remember.

As part of that differentiation, and to keep us from becoming a commodity, we will work with customers to fix their systems. I don't just mean handing them a remediation section in a pentest report like other vendors (ew). I mean pushing PRs and helping them test their systems until the vulnerabilities are resolved. We want to provide solutions, not a pentest report full of problems. What we can control is how we treat customers and my promise which a lot of these vendors forget is that we are here to serve our customers.

Our Metrics

Customer satisfaction. When you're this early, the biggest indicator of customer satisfaction is whether someone is willing to pay for your work, and hopefully not just once. Otherwise they don't really value what you're offering, which means we're either not offering the right thing, these aren't ideal customers, or we need to go back to the lab and rebuild the offer. With that said, revenue is our only output metric for now. On the input side we're tracking things like how often we post and how many meetings we take, because that's what we think leads to revenue.

Actions & Goals

• GTM GTM GTM.

• Turn our 2 booked meetings into at least 1 paying customer by the end of October.

• Post more. We did 4 posts in September. October's goal is 3 a week, cringe and all (ew).

• Ask for more intros. If you know a CISO, a security lead, or anyone shipping AI agents in healthcare or finance, I would love an introduction. No intro is too small.

Things I always try to keep in mind

• David and I won't be able to do it alone. One thing that has been clear to me from the beginning is that building this company will be hard. People have to want us to win, and we will need your help to make that happen.

• At Amazon I didn't learn how to sell or run a business, but I did learn that doing right by your customers is the most important thing you can do. Customers will always want more value, and they will always want it faster. Give them that and they will take care of you.

• We will try new things, and we will fail, but that's the name of the game.

I'll post these numbers every month, good or bad. Come back in November and see if that zero turned into something.

If you made it all the way to the end, I consider you part of the flock. Welcome to the Coo Crew!