# Silverback CTO — Full Site Content (LLM-readable) This file is the concatenated full-text version of the canonical pages on silverbackcto.com, written for retrieval by language model crawlers. The shorter index file is at /llms.txt; the per-page sources of truth are the HTML pages themselves at the URLs noted below. --- # Page: 30 Companies in 30 Days URL: https://www.silverbackcto.com/ ## Hero Launching a company a day for 30 days. Watch what a Silverback CTO founder can do with Agentic Engineering. CTAs: "Follow the Feed" → /builds, "Work With Me" → /work-with-me. ## About strip 30 years as a CTO. 2 years rebuilding everything around AI. This is what that looks like at speed. Founder of Silverback CTO, CogleGroup, and SecureStackScan. Host of Tales From The Sky Lounge. ## Recent builds The home page surfaces the five most-recent published builds from /builds and a stats bar showing companies built, total build hours, and the 30-day denominator. The full feed is at /builds. ## Email capture "Get each daily build in your inbox. No noise. Just the build, the stack, and what actually happened." Subscribers are tagged velocity-subscriber in GoHighLevel and receive a welcome email plus the daily build digest. --- # Page: About Todd Merrill URL: https://www.silverbackcto.com/about ## 30 Years of Building. One Year of Rebuilding. CTO. Founder. Pilot. Builder of things that work. ## The Story Three decades as a Founder, Partner, Builder and Operator in and around PE/VC-backed companies. Architecture decisions, team building, board-level technical communication, and the kind of pattern recognition that only comes from doing it for 30 years. Then AI changed everything. Not gradually — violently. The entire development paradigm shifted this year. Code went from bottleneck to commodity. The new constraint became problem definition — the one thing that still requires human judgment, business acumen, and decades of scar tissue. Silverback CTO was born from that shift. The Velocity Process is the methodology. The 30-day challenge is the public proof. And the consulting practice is the delivery vehicle for PE/VC-backed companies that need senior technical leadership at AI speed. ## Current Ventures **Silverback Ventures.** AI-native venture studio. Equity partnerships and co-founding on high-signal problems where the Velocity Process gives an unfair speed advantage. **Silverback CTO.** Consulting CTO and Venture Partner engagements for PE/VC-backed companies. Board-level technical leadership at AI speed. **CogleGroup.** Enterprise AI Agency to accelerate adoption of critical operational levers. Government and Enterprise Kickstart Programs at https://coglegroup.com/ai-adoption-service-offerings/. ## Essays Long-form writing on the AI-native operating model — venture studio mechanics, the Velocity Process, and what changes when code stops being the bottleneck. https://toddmerrill.substack.com ## Tales From The Sky Lounge A business podcast for PE/VC operators and founders. Conversations about building, scaling, and the uncomfortable truths about technology leadership. ## Pilot Also a certificated commercial pilot. Pattern recognition at altitude. --- # Page: The Velocity Process URL: https://www.silverbackcto.com/velocity ## Hero Silverback Ventures · Venture Studio · AI-Powered Product Execution. The Velocity Process. We don't consult. We co-found. Equity-aligned partnership from day one — business strategy married to product execution the way only a battle-tested founder can. Research in 24 hours. AWS-deployed v1.0 in 10 days. ## Stats 22+ production apps in 6 months. 24-hour research turnaround. 30 years of CTO experience. 10 days to AWS v1.0. ## The Thesis: We Don't Consult. We Co-Found. Silverback Ventures is a venture studio, not an agency. We take equity because we are building alongside you — with the same long-term stake in the outcome. Cash-only engagements are available, but our default is aligned partnership. Leading that partnership: a global top-25 consulting CTO, active AI LP investor, and serial founder with 30 years of experience turning business ambition into products that win markets and attract capital. The result: a co-founder who has already been where you are going. ## The Problem We Solve: The Gap No One Is Filling - Business consultants deliver decks. They can't build the product. - Dev shops and AI coders build what you ask. They can't challenge your strategy. - First-time founders don't know what they don't know — until it's expensive. - Investors fund the vision but can't validate the product-market logic. - 18 months of runway consumed before a real signal is ever captured. ## The Studio Process — Founder-Led at Every Phase **01 Discovery (Day 1).** A founder-to-founder conversation. We pressure-test your business model, identify the real market opportunity, and surface the product decisions that will make or break traction — before a single line of code is written. **02 Research (24-hour turnaround).** Dual-track analysis delivered within 24 hours: business viability (TAM, ICP, go-to-market, pricing model) alongside technical feasibility. The business case and the build plan arrive together — because they are inseparable. **03 Architecture (agreement → locked).** Upon founder sign-off, architecture is locked to the business requirements — not the other way around. Phased roadmap reflects go-to-market milestones, investor timelines, and customer acquisition logic. You approve before build begins. **04 MVP Build (10 days or less).** AWS-deployed v1.0 live in 10 days or less — often a few days. Every build decision traces back to a business requirement. Production-grade from day one: scalable, secure, and shaped by 30 years of knowing what breaks at Series A. **05 Launch & PMF (ongoing).** The product ships into a GTM motion, not a vacuum. First customer acquisition strategy, pricing validation, and metrics wired for PMF signals — all informed by the same business logic that shaped the product. ## For Founders: A Co-Founder With Skin in the Game - Equity-aligned partnership — we win when you win, not by the hour. - Business model pressure-tested by a global top-25 CTO and active LP investor. - Product decisions grounded in market reality and investor expectations. - Production-ready MVP shaped by GTM logic and fundraising milestones. - Network access — PE/VC relationships built across 30 years of deal flow. - Cash-only available — but equity partnership is the default for a reason. ## For PE / VC Investors: A Studio Partner You Can Co-Invest With - Co-invest alongside a global top-25 CTO already embedded in the cap table. - Deal flow from the studio — vetted companies with validated architecture and GTM. - Technical due diligence — independent CTO-level read on any stack or roadmap. - Accelerate portfolio companies from strategy to revenue-generating product. - Exit multiple expansion through products built to scale, not just to demo. - AI transformation roadmaps for portfolio companies at any stage. ## Proof Points: Built Using the Velocity Process - **PodToSite.com.** SaaS platform converting YouTube-based podcasts into LLM-optimized websites. Live in production, live case study in every podcast episode. - **SecureStackScan.com.** AI-powered security assessment platform targeting CTOs and compliance buyers. Full GEO/SEO strategy and production launch in weeks. - **InformedPatient.org.** AI-powered clinical decision support platform. Healthcare partnership pipeline, SOC2/HITRUST roadmap, and EMR integrations architected from day one. - **TrainSavi.com.** Security awareness training LMS built for MSPs and compliance-driven organizations. Full curriculum, reporting, and certification — shipped via the Velocity Process. ## Quote "I've been a founder, a global top-25 consulting CTO, and an LP in AI funds. I know what investors are looking for before a term sheet is written, and I know how to build the product that earns it. That's why we take equity — because I intend to be there when it matters." — Todd Merrill, Founder · Global Top-25 Consulting CTO · AI LP Investor · Silverback Ventures. --- # Page: Work With Silverback CTO URL: https://www.silverbackcto.com/work-with-me Three ways to work together. All built on the Velocity Process. ## 01 — Silverback Ventures · Venture Partner **Who.** Domain-expert founders solving high-signal problems where AI provides an unfair speed advantage. PE/VC operators with portfolio companies that need a co-founding technical partner already on the cap table. **What.** Equity-aligned partnership from day one. Todd builds, co-founds, and serves as Venture Partner — pressure-testing the business model, architecting the product, shipping production-grade v1.0 in 10 days, and staying through PMF. Default engagement is equity; cash is optional. CTA: Tell Me About Your Problem → fantastical.app/toddmerrill/silverback-cto. ## 02 — Consulting CTO **Who.** PE/VC-backed companies $10M–$500M that need senior technical leadership at AI speed — board-level engagement, technical strategy, AI transformation roadmaps, technical due diligence for portfolios. **What.** Embedded technical leadership shaped by 30 years of CTO experience and recognition as a global top-25 consulting CTO. Engagement structure aligned with venture timelines, not hourly billing. Architecture, team, strategy, board communication — without the full-time cost. CTA: Book an Intro Call → fantastical.app/toddmerrill/silverback-cto. ## 03 — Silverback AI Agency **Who.** Companies and portfolio operators that need the Velocity Process applied to a specific problem on a defined timeline. **What.** Rapid MVP development on the Velocity Process. AI integration strategy. Technical due diligence for investor portfolios. Cash engagement, scoped delivery, no equity required. CTA: Let's Talk → fantastical.app/toddmerrill/silverback-cto. Not sure which fits? Book 30 Minutes → fantastical.app/toddmerrill/silverback-cto. --- # Page: Day 1 — SecureStackScan URL: https://www.silverbackcto.com/builds/day-01-securestackscan - Day: 1 - Date: 2026-05-01 - Industry: Cyber Security / MSP Channel - Build time: 80 hours - Stack: Next.js 14, AWS Lambda, DynamoDB, Claude Sonnet 4.5 via Bedrock, MCP Server, Cognito, Stripe. - Live URL: https://securestackscan.com - Published: 2026-05-01T13:00:00Z **Problem.** Security assessments for AI-generated codebases still use the checklists built for human-written code. The vulnerability surface is different. The channel that scales those assessments is missing. ## Day 1 of 30 Welcome to the 30-day Velocity Process challenge. Thirty days, hopefully 30 ventures, seven themes about where the universe is going. We're starting where the proof already exists — production code, real research, paying customers. SecureStackScan is an AI-native security assessment platform that every early stage CTO needs to bootstrap a security program. It is built so a vibe coder can get value but it is primarily built for the MSSP to manage a fleet of clients. We couldn't have brought this forward a year ago. With agentic coding tools and experience in the domain to know exactly what needed to be built, SSS is a reality and is part of a coordinated system of sophisticated security tools. It's the stack that we give every Software client at a price point that was not possible in the past. Today is its formal entry as Day 1 of the 30 Companies in 30 Days arc, and the kickoff for Theme #1: the Cyber Security MSP / SMB channel motion. ## What it does SecureStackScan interacts with your code and your cloud infrastructure to produce an assessment that an MSP or vCISO can hand to an SMB client without translating from engineer-speak, while providing all the details needed for a robust remediation. The CISO MCP endpoint exposes the entire scoring engine to AI agents directly — so a vCISO running Claude Desktop can ask "what's the security posture of this client's stack?" and get a structured answer pulled from live data. Analysis includes: - Static and dynamic AI code analysis straight out of GitHub. - Cloud asset discovery via credentialed access on AWS, Azure, and GCP. - Native cloud security assessment for each platform. - Generated as-built infrastructure diagram with notes on security issues. - Basic authenticated webapp pentest. - A unified report ready for an auditor with remediation advice pointing to the source code. We surround this core with a Vibe Code Check (today it's still free): enter your app's URL and start understanding why common coding tools are just a start (Insecure by Default). Then on the mature end, we offer partnership with an operating vCISO group and get you started with a pre-audit assessment and an onramp to a robust security program with connections into other pieces of software that the CISO will operate for you. The thing that makes it different from existing scanners is the channel framing. Snyk, Semgrep, Wiz — all sell to engineering teams. SecureStackScan sells to the people who serve engineering teams: MSPs, vCISOs, fractional CISOs, compliance partners. The output format, the pricing, and the integration surface are all built around the channel motion, not the buyer. ## Why Day 1 Three reasons. First, the research is the proof. Insecure by Default is a public, citable study showing what 600 production AI-generated codebases actually got wrong. The headers that platforms auto-configure (HSTS, X-Content-Type-Options) hit 93–100% adoption. The headers that need app-level config (CSP, X-Frame-Options) sit at 0–2%. SecureStackScan is the platform that found that. Second, it's a CyberSavi family launch with continuity. This week is the CyberSavi week — six ventures from one operator team telling one story across days 1–8. SecureStackScan finds the gaps. CompliancePulse (Day 4) runs continuous compliance against them. CyberSavi Academy (Day 5) trains the people who run it. CyberSavIQ (Day 6) extends to the personal/reputation layer. GovernAI (Day 8) overlays AI governance for the EU AI Act moment. By Friday, the channel-motion thesis lands as fact. Third, production beats prototype as a Day 1 anchor. The 30 days isn't "30 cold-start MVPs in 30 days." It's "30 days of building in public, with the real ventures from a real pipeline." SecureStackScan is already live, already finding things, already supporting multiple SOC2 Type I audits. That sets the credibility bar for everything that follows. ## The Velocity Process notes What Claude Code handled: the assessment engine implementation, the MCP server scaffolding, the AWS infrastructure provisioning via VelocityStack, every line of test coverage, and 100% of the dashboard UI. One coder, huge leverage. What required human judgement: the choice to build the CISO MCP endpoint at all (no competitor has one), the decision to sell to channels and not buyers, the Insecure by Default study design, and the integration-first pattern to support MSSP operations. None of those choices come from intelligence — they come from 30 years of watching what makes a security tool actually get adopted versus shelved. What broke: with the MCP spec changing rapidly and support for OAuth emerging as a requirement, the design of the desktop support was a little tricky to get deployed effectively. This is the first tool out of the gate and finding a way to coordinate all the changes needed by the team forced us to adopt new organization patterns (more on that later with Planwright). ## What's next this week - Day 2 (Sat May 2): SecureLink launch — CMMC-compliant dedicated public IP for CGNAT SATCOM used by federal contractors and defense orgs. The channel-motion thesis carries. - Day 3 (Sun May 3): PartFoundry launch — on-demand replacement-parts manufacturing for the $15B+ obsolete/discontinued parts market. First fully public build of the run: repo, business plan, and build-session screenshots all open. Game-day switch from Florida Condo Tracker; the Sequoia / Julien Bek autopilot-thesis activation moves to Day 9 alongside the CogleGroup GP partnership announcement. - Day 4 (Mon May 4): CompliancePulse launch — the CyberSavi family product that's already in revenue. - Day 5 (Tue May 5): CyberSavi Academy launch. - Day 6 (Wed May 6): CyberSavIQ launch. - Day 7 (Thu May 7): Theme essay — EU AI Act 2026, the most underpriced regulatory tailwind. - Day 8 (Fri May 8): GovernAI launch — closes the CyberSavi family week. Then Week 2 leaves cybersecurity behind and moves to discoverability. Stick around for that one. ## Want to talk If you run an MSP, a vCISO practice, or a fractional CISO desk and want SecureStackScan running against your client codebases — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. The channel motion is what we're optimizing for; you're the channel. If you want every build delivered to your inbox, the email signup on the home page is wired straight to GoHighLevel. No noise, just the build, the stack, and what actually happened. --- # Page: Day 2 — SecureLink URL: https://www.silverbackcto.com/builds/day-02-securelink - Day: 2 - Date: 2026-05-02 - Industry: Cyber Security / Federal & Defense - Build time: 40 hours - Stack: AWS GovCloud, strongSwan IKEv2/IPsec, AWS-LC FIPS 140, ACM Private CA, CDK on VelocityStack, DynamoDB. - Live URL: https://securelinkvpn.io - Published: 2026-05-02T13:00:00Z **Problem.** Starlink and Starshield put every device behind CGNAT, so field-deployed federal teams can't get a publicly routable IP for HQ allowlists, surveillance backhaul, or CMMC-aligned egress. Off-the-shelf VPNs don't survive the audit. Enterprise alternatives require a security team the SMB-tier contractor doesn't have. ## Day 2 of 30 Day 1 SecureStackScan went live as the assessment platform that finds the gaps and produces a report the MSP can hand the client. Today's launch is the network-layer companion: SecureLink — a publicly routable, FIPS 140-validated static IP for Starlink, Starshield, and other CGNAT-locked SATCOM links. Same channel. Same buyer. One layer deeper into the compliance stack. ## What it does Starlink and Starshield put every customer terminal behind Carrier-Grade NAT. From the public internet, you cannot reach a device on a Starlink link directly — there is no inbound IP to hit. For a field-deployed federal contractor (surveillance crews, drone ground stations, mobile command posts, range telemetry, deployable CUI workstations), that is the connectivity gap that kills the contract. The market is asking for one thing: a publicly routable IPv4 address that travels with the device. HQ allowlists it. The contracting agency allowlists it. The SOC sees it in the audit log. It does not change when the bird hands off or the dish reboots. SecureLink delivers that, in two SKUs: - Software SKU — a Windows install (.NET 6) that opens a FIPS-mode IKEv2/IPsec tunnel from the workstation to the SecureLink edge in AWS GovCloud. Zero hardware to ship. The MSP pushes it through their existing RMM. The static IP belongs to that device. - Router SKU — a managed CPE for sites that need an always-on tunnel for everything behind it: cameras, sensors, IoT, non-Windows workstations, the whole rack. Pre-provisioned with the customer's device certificate and Elastic IP. Same edge. Same crypto. Same audit log. The MSP picks the SKU per site. ## Why this is a federal product, not a commercial one Crypto is FIPS 140 validated end-to-end — AWS-LC FIPS Module on the edge, Windows CNG in FIPS mode on the client. Infrastructure runs in AWS GovCloud. Consumer and business VPNs (NordLayer, Tailscale, Twingate) cannot match that without re-architecting. That matters because the same contractor who needs the routable IP also has to satisfy CMMC Level 2 — roughly 110 NIST 800-171 controls, with enforcement ramping through 2026–2027. SecureLink ships deterministic auditable egress, access logs in CMMC-acceptable format, certificate-based authentication, and FIPS 140-validated cryptography out of the box. One product solves the Starlink CGNAT problem and the CMMC L2 audit story at the same time. ## Why Day 2 The Cyber MSP cluster runs six ventures across days 1–8 against one thesis: the buyer of SMB cybersecurity isn't the SMB. It's the MSP that serves the SMB. SecureLink is the cleanest expression of that thesis. The federal contractor is the SMB-tier of the defense industrial base. The MSP that serves them is the channel. CMMC enforcement is the forcing function. Six of the seven Cyber MSP cluster ventures are from the CyberSavi family (SecureStackScan, CompliancePulse, CyberSavi Academy, CyberSavIQ, GovernAI). SecureLink sits alongside them as the same thesis applied to a different vertical. ## The Velocity Process notes What Claude Code handled: the strongSwan IKEv2/IPsec configuration generator (FIPS mode, AES-256-GCM, ECP-384), the Elastic IP allocation logic, the ACM Private CA device-certificate flow, the access-log formatter, the Windows .NET 6 install client and PowerShell VPN profile creation, the router-SKU image pre-provisioning pipeline, and the AWS GovCloud infrastructure via VelocityStack. What required human judgement: anchoring the product on the Starlink CGNAT pain rather than leading with CMMC; shipping two SKUs (per- workstation software and site-wide managed router) instead of forcing one model; publishing the FIPS validation evidence publicly. What broke: the first access-log formatter joined identifier fields in the wrong order. NIST 800-171 says timestamp first, then event type, then actor identity. Two hours to find, ten minutes for Claude Code to fix versioned across the Windows client and the router image. ## Want to talk If you run an MSP, vCISO, or fractional CISO desk serving federal contractors or DIB-adjacent SMBs — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. SecureLink pricing is per-end-client, designed for your margin. --- # Page: Day 3 — PartFoundry URL: https://www.silverbackcto.com/builds/day-03-partfoundry - Day: 3 - Date: 2026-05-03 - Industry: On-Demand Manufacturing / Replacement Parts - Build time: 3 hours (one Claude Code quota session) - Stack: Next.js 14 (App Router, standalone), AWS Cognito, DynamoDB single-table, S3 presigned uploads, Stripe Checkout + webhook, ECS Express Mode on Fargate, CDK v2 on @silverbackcto/velocity-stack, shadcn/ui orange theme. - Live URL: https://partfoundry.shop - GitHub: https://github.com/toddamerrill/part-foundry - Published: 2026-05-03T18:00:00Z **Problem.** The original manufacturer doesn't make the part anymore. The aftermarket gave up. Vintage cars, discontinued appliances, and industrial equipment that outlived their parts catalogs sit waiting for the one piece nobody stocks. Right-to-Repair is law in more states every quarter, smartphone photogrammetry is finally consumer-grade, and desktop additive printers hit production tolerances at 1/10th the cost of five years ago. The market is a $15B+ gap; the on-ramp is trust and craft. ## Day 3 of 30 — game-day switch This morning's plan was Florida Condo Tracker. By 9am Sunday I'd looked at the FCT branch, didn't like the state of repair, and pulled a fresh build off the bench instead: PartFoundry — an on-demand replacement- parts manufacturing platform serving the $15B+ obsolete and discontinued parts market. One quota session. 9:45am scaffold to ~12:10pm quota- reached banner. Three commits. Live at partfoundry.shop, repo public at github.com/toddamerrill/part-foundry, business plan published as a sibling doc. This is the first fully public build of the 30-day run. Repo open, business plan open, screenshots of the actual quota session embedded on the build page. If you want to see what one Sunday morning of agentic coding actually looks like — start to quota — it's all there. ## What it does Three service tiers, one platform: - Catalog ($25-75) — pre-modeled parts already in the library. Vintage car knobs, appliance shelf clips, industrial housings. Order, print, ship. 3-7 days. - Scan & Print ($75-150) — customer ships the part, we scan it, we print it. The reference part comes back with the replacement. - Reverse Engineer ($150-500) — broken or partial part. Materials science + CAD inference + symmetry reconstruction. - AI Scan / PartScan (Phase 3, provisional patent track) — smartphone- only capture with AR-guided quality feedback and AI geometry completion. Months 9-18 on the roadmap. Materials in stock today: PLA, PETG, ABS, Nylon (PA12), Resin (Tough 1500), and metal via partner network. ## Founding team - Taylor Merrill — Founder & Chief Engineer. Plastics engineering, Rubbermaid production background. Owns material selection and quality. - Aaron Vedlitz — Production Lead & Design Partner. CAD, 3D modeling, post-processing. Aaron is also @eldritchcosplays — an award-winning prop fabricator (Best Craftsmanship at DragonCon, Best in Show at MomoCon). - Todd Merrill — Consulting CTO. The Eldritch Cosplays archive is the on-ramp. Cosplay is not the market — it's the credential. ## Why Day 3, why a game-day switch The original Day 3 was Florida Condo Tracker — a regulated-compliance autopilot for HB 1203. I'd planned it as the Sequoia / Julien Bek autopilot-thesis activation slot. That thesis still applies and FCT will land later in the run, but this morning it wasn't ready and PartFoundry was. The Sequoia activation moves to Day 9 — CogleGroup GP launch. PartFoundry's own thesis: physical goods are a real Velocity Process target. Most of the 30-day run is software ventures. PartFoundry proves the same operating model — agentic coding, single quota session to MVP, public repo + public business plan, design partner / co-founder structure — works when there's a printer in the loop and physical fulfillment on the back end. ## The numbers From the public business plan: - TAM: $15.2B combined (Classic Car Restoration $8.2B / 6.8% CAGR + US Appliance Repair Parts $7.0B / 2.5% CAGR) - Year 1 target: 1,800 orders × $85 avg = $153K revenue, break-even Month 5 - Year 3 target: 10,000 orders × $105 avg = $1.05M revenue, 34% net margin - Tier 1 unit economics example (vintage car dashboard knob): COGS $17 / sale price $45 / 62% gross profit ## The Velocity Process notes What Claude Code handled: Next.js 14 scaffold and shadcn/ui orange theme; AWS Cognito + DynamoDB single-table + S3 + Stripe wiring; CDK v2 stack split with VelocityStack tagging; the order intake form across all three tiers; the photo uploader with drag-and-drop + presigned PUT; the workshop-editorial landing redesign; the Instagram embed component with permalink-or-fallback switching. What required human judgement: publicizing the repo and the business plan instead of keeping them private; leading the landing page with Aaron's Eldritch Cosplays archive rather than vintage-car or appliance imagery; swapping FCT off the day-3 slot at 9am instead of forcing a build whose state of repair I didn't trust. What broke: first version of the Instagram embed loaded embed.js unconditionally — third-party script ran on every visit even when no permalinks were set. Fixed in-session: lazy-load only when at least one card has a real permalink. ## Want to talk If you restore vintage cars, repair appliances anyone forgot about, or maintain industrial equipment whose original parts catalog has been out of print since the Carter administration — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. Founding-customer pricing (20% lifetime discount) on the first 100 orders. Repo: github.com/toddamerrill/part-foundry. --- # Page: Day 4 — CompliancePulse URL: https://www.silverbackcto.com/builds/day-04-compliancepulse - Day: 4 - Date: 2026-05-04 - Industry: Cyber Security / MSP — Continuous Compliance - Build time: 80 hours - Stack: Docker MCP servers, Microsoft Graph (O365), AWS Lambda, Postgres + pgvector, Claude Sonnet 4.5 + Haiku 4.5 via Bedrock, Cognito, Stripe. - Live URL: https://cybersavi.com/compliance-pulse (existing customer sign-in at pulse.cybersavi.com) - Published: 2026-05-04T13:00:00Z **Problem.** After the security assessment is done, the gaps are documented. Then what? Continuous compliance is manual, ad-hoc, and doesn't fit the per-end-client economics MSPs need to scale a vCISO offering profitably. ## Day 4 of 30 Back to the CyberSavi cluster. CompliancePulse is live — and unlike everything else launching this month, it's already in revenue. CompliancePulse is the spine of the CyberSavi MSP operating system. It calls out to and gathers from every other product in the family — pulls the gap inventory from SecureStackScan, fires training assignments into CyberSavi Academy, watches the dossier and perception signal off CyberSavIQ, syncs AI-policy posture to GovernAI — and turns all of it into one continuous-compliance posture per end-client tenant. Every other CyberSavi product is an arm. CompliancePulse is the body. As of today, MSP partners can enroll at cybersavi.com/compliance-pulse with framework coverage across NIST 800-171, CMMC L2, SOC 2 CC, HIPAA and ISO 27001. ## What it does The vCISO economics problem: an MSP can run a one-time security assessment for an SMB client in maybe 4 billable hours. Continuous compliance — the actual work that earns the vCISO retainer — is dozens of hours a month per client, most of it tedious. At $99–199 per end-client per month, the MSP cannot afford to do it manually. CompliancePulse runs a Docker MCP server per client tenant, ingests Microsoft 365 / Google Workspace configuration, and watches for control drift in real time. When it sees something — a new external sharing rule, a deactivated MFA, an unmanaged device joining — it doesn't just log it. It calls the rest of the OS: - Inbound from SecureStackScan: the original gap inventory and the as-built infrastructure diagram. - Outbound to CyberSavi Academy: the user who failed MFA gets the MFA training module assigned the same day. Training is a remediation action, not a calendar event. - Bidirectional with CyberSavIQ: dossier and LLM-perception signals on owners and key staff feed the personal-risk picture; CompliancePulse routes them into the same evidence package the auditor sees. - Outbound to GovernAI: every AI-policy violation lands in the same continuous-evidence stream as the SOC-2 / CMMC / HIPAA controls. One posture, one auditor view, one bill. Per detection rule, the policy citation is published. Per cross-product hook, the contract is published. The MSP buys CompliancePulse once. Each end-client gets a tenant. The vCISO sees fifty clients in one dashboard. ## Why Day 4 Already in revenue. Not "AWS Deployed." Not "Coded." Revenue. Paying customers. Real channel partners running it on real client books. Days 1–3 framed the thesis (channel motion, autopilot economy, public build). Day 4 shows what the thesis looks like once it's working in production with real money attached. The marketing surface goes public today. CompliancePulse has been running under WinterMedia auth with a small set of MSP partners. As of this morning, cybersavi.com/compliance-pulse is open: framework coverage matrix, published pricing ($99–199 per end-client / month, on the page in dollars, no quote-request gate), the hub-and-spoke architecture, and an operator-side walkthrough. ## The Velocity Process notes What Claude Code handled: the entire Docker MCP server architecture (one container per client tenant, isolation enforced at network and IAM layer), the Microsoft Graph integration, the control-drift detection logic, the evidence-package generator, the multi-tenant Postgres + pgvector schema, the Stripe per-end-client billing flow. What required human judgement: using Docker MCP rather than a lambda-per-client architecture (more expensive, but the auditor- explainability of "your tenant runs in its own container with its own credentials" is the moat); making every detection rule explainable down to the underlying policy citation; shipping the M365 connector first and Google Workspace second. What broke: the first version of the control-drift detector flagged every external-share-link change as a violation, including legitimate ones the client had explicitly approved. Fix: per-client allowlist with a rolling 90-day attestation expiry — when the auditor's review window opens, the allowlist gets a fresh review automatically. ~3 hours of human design, 90 minutes of Claude Code implementation. ## The CyberSavi family arc — hub-and-spoke, not sequential - Day 1 SecureStackScan finds gaps and feeds them into CompliancePulse. - Day 4 CompliancePulse is the operating system. It calls out to and gathers from the other four. - Day 5 CyberSavi Academy receives training assignments from CompliancePulse and reports completion back into the evidence stream. - Day 6 CyberSavIQ feeds personal/reputation signal on owners and key staff into CompliancePulse's per-tenant risk picture. - Day 8 GovernAI receives AI-governance posture and policy hooks from CompliancePulse and writes back AI-control state to the same evidence package. ## Want to talk If you run an MSP, vCISO, or fractional CISO desk and want to evaluate CompliancePulse against your current stack — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. The product is in revenue and the channel intake is open. --- # Page: Day 5 — CyberSavi Academy URL: https://www.silverbackcto.com/builds/day-05-cybersaviacademy - Day: 5 - Date: 2026-05-05 - Industry: Cyber Security / MSP — Training & Awareness - Build time: 70 hours - Stack: Next.js 14, AWS App Runner, DynamoDB, Claude Sonnet 4.5 via Bedrock, S3 + CloudFront video, SCORM 1.2 + xAPI, Cognito, Stripe. - Live URL: https://cybersaviacademy.com - Published: 2026-05-05T13:00:00Z **Problem.** MSPs run the assessment, the compliance engine flags gaps, but most gaps that actually cause breaches are people: phishing susceptibility, password hygiene, social engineering. Existing security training is generic, check-the-box compliance theater that the client clicks through and forgets. ## Day 5 of 30 Day 5 of the CyberSavi family arc. CyberSavi Academy — cybersaviacademy.com — is live. Training layer of the stack. The MSP runs the SecureStackScan assessment. CompliancePulse closes the technical gaps. CyberSavi Academy handles the gaps that aren't technical — the ones that walk in through the front door and click on a phishing link. ## What it does CyberSavi Academy is a multi-tenant security awareness training platform built for the MSP channel. Every end-client gets a branded learning environment under the MSP's domain, scoped to that client's industry and risk profile. The training catalog covers the standard awareness fare (phishing, password hygiene, social engineering, mobile device security) plus role-specific modules (executives get business-email-compromise training, clinicians get HIPAA-handling, finance staff get wire-fraud and ACH-takeover). Three things make this a real product instead of compliance theater: 1. The training is dynamic, not pre-recorded. Modules are assembled on the fly using Claude Sonnet 4.5 against the latest threat intelligence — when a new phishing campaign hits the wild, the training reflects it within 48 hours. 2. It integrates with CompliancePulse. When the compliance engine flags an MFA failure for a specific user, that user gets assigned the MFA training module the same day. Training is a remediation action, not a calendar event. 3. The reporting is auditor-grade. SCORM 1.2 + xAPI on the back end, completion certificates with cryptographic signatures, evidence packages that drop directly into the auditor's review folder. The product is in production, used inside the CyberSavi family of MSPs. ## Why Day 5 The CyberSavi family week is structured so that each day adds one layer to the stack: assess, secure egress, run continuous compliance, train. Day 5 is the human layer. When training is an automated remediation step tied to actual control failures, the click-through rate on simulated phishing drops 40-60% inside three months. That's not awareness theater. That's a measurable risk-reduction control. ## The Velocity Process notes What Claude Code handled: the entire Academy engine (multi-tenant module assignment, progress tracking, certificate issuance), the SCORM 1.2 + xAPI compliance, the auto-assignment hooks from CompliancePulse, the dynamic-module generation pipeline against fresh threat intel, the AWS App Runner deployment via VelocityStack. What required human judgement: supporting SCORM 1.2 specifically (and not SCORM 2004 — SCORM 1.2 is what actual MSPs and their auditor toolchains expect); shipping dynamic training modules instead of a pre-recorded library; making completion certificates cryptographically signed (most LMS platforms ship plaintext PDFs that auditors stopped trusting around 2018). What broke: scaling SES on AWS. Breaking out of the sandbox is still a process and we missed an initial validation email which put this project and sibling projects in the penalty box. Lesson: make sure you have an overall admin email to catch all CC: emails on critical notifications. ## Want to talk If you run an MSP / vCISO / fractional CISO and need a training layer that isn't compliance theater — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. CyberSavi Academy is in production and onboarding new MSP partners now. --- # Page: Day 6 — CyberSavIQ URL: https://www.silverbackcto.com/builds/day-06-cybersaviq - Day: 6 - Date: 2026-05-06 - Industry: Cyber Security / MSP — Personal & Reputation Layer - Build time: 65 hours - Stack: Next.js 14, AWS App Runner, DynamoDB, Claude Sonnet 4.5 + Haiku 4.5 via Bedrock, OSINT collectors, Docker MCP server, Cognito, Stripe. - Live URL: https://cybersaviq.com - Published: 2026-05-06T13:00:00Z **Problem.** Existing personal-cybersecurity tools tell the SMB owner what data brokers know about them and what passwords leaked in a breach. They do not tell them what the major language models say about them when their customers, hires, or counterparties ask. Reputation has moved into a new substrate; nobody has been monitoring it. ## Day 6 of 30 Day 6 of the CyberSavi family arc. CyberSavIQ — cybersaviq.com — is live. Personal and reputation layer of the stack. The MSP runs the SecureStackScan assessment. CompliancePulse closes the technical gaps continuously. CyberSavi Academy trains the people who walk through the gaps. CyberSavIQ covers the owner — the SMB founder, the family principal, the household-and-business package the MSP sells as one relationship. ## What it does CyberSavIQ produces two coupled artifacts per subject — Internet Dossier and LLM Perception Report — and feeds the resulting risk signal into the MSP's CompliancePulse evidence package on a per-tenant basis. $4.99 per individual report; bundled into the MSP's household-and- business retainer for recurring coverage of the owner, the spouse, and any dependents the MSP and the SMB owner agree should be in scope. Three things make this a real product instead of another data-broker- removal service: 1. Internet Dossier — done thoroughly, not just data-broker scrubbing. OSINT against the open web: data-broker records (the standard 80+ source removal target), public-records traces, breach exposure via HIBP and adjacents, social-graph artifacts, leaked credential pairs, address trails. The dossier is the factual layer. 2. LLM Perception Report — the half nobody else is shipping. Probe the major language models (Claude, GPT, Gemini) with controlled prompts about the subject, parse what each model confidently asserts, and flag the gaps between the dossier ground truth and the model output. Stale facts. Hallucinated associations. Real-but-unflattering surfaces. This is what the SMB owner's customers read about them when they ask their assistant before the call. 3. Couples to CompliancePulse. The signals feed the per-tenant CompliancePulse risk picture as a bidirectional signal — the same evidence package the auditor sees, now with owner-level personal exposure as a first-class control. ## Why Day 6 Day 6 turns the cluster from technical-control coverage into household- and-business coverage — the layer that makes the SMB-owner relationship sticky. Reputation in 2026 is no longer "what does the first page of Google say." It's "what does the assistant tell my buyer when she asks." That's a different surface, and it's actively unmonitored at the SMB-owner layer. ## The Velocity Process notes What Claude Code handled: the OSINT collector pipeline (multi-source ingestion + dedupe + normalization), the LLM-perception probe (rate- limited concurrent probing across Claude, GPT, Gemini with controlled prompts and structured output), the report renderer, the MCP server that exposes the per-subject signal to CompliancePulse, the Stripe per-report flow. What required human judgement: shipping LLM perception at all (most personal-cyber products won't touch it because it's slippery — but it's the part of the surface that matters now); keeping the retail price at $4.99 even though the recurring MSP bundle is the real ARPU number; making the dossier-versus-perception delta the centerpiece of the report rather than a side panel. What broke: prompt-injection attacks against the LLM-perception probe. Early versions got reflected back — data-broker results contained crafted strings that, when concatenated into a prompt for the perception probe, manipulated the model into producing prompts back to the user. Hardened the probe with a sanitizer that strips prompt- injection-shaped content from data-broker results before any reaches a model, plus a structured-output schema so the perception output cannot escape into freeform model voice. ## What's next this week - Day 7 (Thu May 7): Theme essay — EU AI Act 2026, the regulatory tailwind. - Day 8 (Fri May 8): GovernAI — closes the CyberSavi family week. ## Want to talk If you run an MSP / vCISO / fractional CISO desk and your offering stops at the firewall — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. CyberSavIQ is in production at cybersaviq.com and onboarding new MSP partners under the household- and-business bundle now. --- # Page: Day 7 — TrainTogether (+ EU AI Act 2026 theme essay) URL: https://www.silverbackcto.com/builds/day-07-traintogether - Day: 7 - Date: 2026-05-07 - Industry: Consumer Fitness / Goal-Oriented Community - Build time: 4 hours - Stack: Next.js 14 (landing), AWS App Runner, DynamoDB, VelocityStack CDK, Cognito (planned), Stripe (planned). - Live URL: https://traintogether.dev - Published: 2026-05-07T13:00:00Z **Problem.** Existing fitness apps were built for solo workouts (Strava, MyFitnessPal) or for swiping (everything dating-adjacent). None of them match training partners by shared goal, schedule, and proximity. Survey of 82 responses pulled from a 4,000-person Atlanta run-club community: 76% say goal-based matching is the killer feature; scheduling conflicts are the top cited pain point. ## Day 7 of 30 — pivot Two artifacts today, by design and by accident. The plan said Day 7 was the EU AI Act 2026 theme essay — *When the Bot Disappears* — the regulatory tailwind that sets up tomorrow's GovernAI launch. That essay still drops, on the Substack, today. AND Day 7 has a build, because the deal demanded it. TrainTogether is the first publicly-disclosed deal under the **Velocity Studio** model. Landing site is live at traintogether.dev; Atlanta beta launch is tracking to Q3 2026. The schedule shift is the story — live in public means owning the calendar changes too. ## What it is TrainTogether is a goal-oriented community fitness platform. It matches training partners on three axes that no existing app handles together: shared goal (marathon training, strength program, race prep), compatible schedule, and proximity. The wedge is large athletic communities where the partnerships obviously want to form and the tooling does not yet exist. The founder is Philippe Kabasele — non-technical, former D1 football player, runs with a 4,000-person Atlanta run club. He pulled 82 survey responses out of his own community in days. The data confirmed what he already knew: 76% want goal-based matching, scheduling is the top pain, existing apps don't address either. The opportunity is the partnerships that obviously want to form inside Philippe's community — and have no tooling to find each other. ## Why a Velocity Studio deal, not a Velocity Process build Days 1–6 were Silverback-built ventures. TrainTogether is different: Philippe is the founder, Velocity Studio is the partner. He brings the community, the survey-validated demand, and the conviction. Velocity Studio brings the build, the GTM operator, and the AWS infra. Equity- aligned, capital-light. $50K launch budget covers build-and-launch sprint plus a modest founder-runway reserve — small enough that a syndicate of friendly angels can fully cover it without a traditional priced round. A CMO advisor (Virginie Gillet) is placed alongside the capital. Strategic advisor Alan is in place from the February 2026 strategy pivot. ## Why Day 7 The essay was always the Day 7 plan. TrainTogether got slotted in because the deal demanded it — the first conversations with friendly co-investors are starting now and the public surface had to be live to support them. Pretending the Day 7 plan was always TrainTogether reads dishonest. Owning the pivot openly is part of the post. ## What's next this week - Day 8 (Fri May 8): GovernAI launch — closes the CyberSavi cluster. The EU AI Act framing from today's essay lands as a product. - Day 9 (Sat May 9): CogleGroup GP partnership announcement — the Sequoia / Julien Bek autopilot-thesis activation moves here. ## Want to talk If you're an angel in our warm network and the TrainTogether deal shape is what you've been waiting for — non-tech founder with real community, survey-validated demand, launch budget a syndicate can fully cover, studio alongside doing the build and the GTM — book 30 minutes at fantastical.app/toddmerrill/silverback-cto. If you're an MSP or vCISO who wants the EU AI Act framing for your client conversations — the essay is on Substack today and tomorrow's GovernAI launch turns the framing into a product. --- # Page: Day 8 — GovernAI URL: https://www.silverbackcto.com/builds/day-08-governai - Day: 8 - Date: 2026-05-08 - Industry: Cyber Security / MSP — AI Governance - Build time: 100 hours - Stack: Next.js 14 App Router, AWS ECS Fargate ARM64, API Gateway + Lambda (Node 20), Postgres 16 + pgvector (RDS), Claude Sonnet 4.5 + Haiku 4.5 via Bedrock, Cognito (multi-tenant), react-pdf, AWS SES, VelocityStack CDK. - Live URL: https://governai.cloud - Published: 2026-05-08T13:00:00Z **Problem.** August 2, 2026: EU AI Act high-risk deployer obligations come into force. Every regulated SMB in Europe — and every U.S. SMB with a European customer, vendor, or beneficial owner — has a live obligation. The people those SMBs call when something legal touches IT are their MSP and their vCISO. Vanta and Drata don't cover it yet. Cynomi has a roadmap. Most vCISOs are stitching together Notion templates and praying. There is no defensible, per-end-client-priced AI governance program an MSP can stand up in 48 hours. ## Day 8 of 30 — the cluster closes GovernAI is live at governai.cloud — and it closes the CyberSavi family week. Five ventures from one operator team in eight days. SecureStackScan finds the gaps. CompliancePulse runs continuous compliance against them. CyberSavi Academy trains the people who run it. CyberSavIQ extends to the personal/reputation layer. GovernAI overlays AI governance for the EU AI Act moment. By this morning, the channel-motion thesis lands as fact, not pitch. GovernAI is the AI governance module Cyber Savi MSPs and vCISOs use to stand up an ISO 42001 / NIST AI RMF / EU AI Act program for an SMB client in 48 hours — and keep it continuously compliant for less than the cost of a steakhouse lunch per month. ## What it does Five complete framework libraries, loaded on day one and cross-mapped to each other: ISO/IEC 42001:2023 Annex A (38 controls), NIST AI RMF 1.0 plus the GenAI Profile (84 subcategories), EU AI Act deployer obligations (29 duties, tier-mapped to Articles 6, 9, 13, 14, 50), Colorado AI Act (12 obligations, effective February 2026), NYC Local Law 144 (4 hiring-AEDT duties). 167 controls in total, sitting in the database, cited in every artifact. A 30-minute conversational risk interview driven by Sonnet, scoring seven dimensions: bias, hallucination, data leakage, IP contamination, explainability, dependency, provider concentration. One-hour prompt cache on the framework knowledge base. pgvector top-K=8 retrieval over prior assessments — the second client looks sharper than the first. Eight client-specific policies generated in under two minutes — Acceptable Use, Procurement, Data Handling, Output Review, Model Lifecycle, Third-Party Vendor, Incident Response, Board Oversight. Every claim footnoted to a real control ID. A second Haiku pass validates citations before the vCISO publishes. Signed-link employee acknowledgement workflow. Board-ready PDF in under 30 seconds, MSP-branded, KMS-encrypted in S3. Public AI Trust Center per client. AI incident register with a Sonnet-generated structured response playbook (with EU AI Act Article 73 trigger detection). The unfashionable choice made on purpose: vCISO-in-the-loop on everything. No auto-send. No shipped-to-employee policies the human practitioner hasn't read. The model does the typing. The vCISO does the judgement. ## Why Day 8 Two reasons. The cluster needed a closer — Days 1, 4, 5, 6 built up the CyberSavi family; Day 7 (TrainTogether + the EU AI Act Substack essay) set up the regulatory tailwind; Day 8 lands the product that turns the tailwind into revenue. And the August calendar is real — Friday before the GovernAI Substack thesis drop on Saturday is the highest-signal slot of Week 1. ## The Velocity Process notes Claude Code handled the entire ECS Fargate deployment under VelocityStack, all five CDK stacks (IAM/Data/API/Frontend/Monitoring), seven Lambda handlers, the Postgres + pgvector schema across 8 migrations, the seed loaders for all 167 controls, the React-PDF renderer, the Bedrock client with prompt-caching wrapper, the PII scrubbing pipeline, the Cognito multi-tenant setup, every line of the Next.js 14 App Router frontend across 22 pages. 14,169 LOC across src/. 26 commits since the Day 2 bootstrap. What required human judgement: Postgres + pgvector over DynamoDB (the workload is multi-table joins plus vector RAG); the Sonnet/Haiku model split (quality where it matters, speed where it doesn't); the vCISO-in-the-loop guardrail as non-negotiable; per-end-client pricing; coexisting with Cynomi/Vanta/Drata rather than displacing them; manual + CSV intake first (native M365/Google OAuth discovery deferred to Sprint 3). What broke: the first version of the policy generator produced beautiful-looking but occasionally fabricated control IDs. Fix was the Haiku validation pass — walks every footnote, flags any that don't resolve to a control ID actually loaded in the database. Publishing is blocked until the vCISO resolves every flag. ## What's next - Day 9 (Sat May 9): CogleGroup GP partnership announcement — the Sequoia / Julien Bek autopilot-thesis activation, alongside the Anthropic Claude Partner Network and the new coglegroup.com Astro 5 rebuild. - Saturday morning: TFTSL Week 1 wrap drops — 60 seconds per build, all eight in one episode. - Saturday on Substack: the long-form GovernAI thesis — *AI governance is the next per-end-client SKU* — drops as the Week 1 anchor essay. ## Want to talk If you run an MSP / vCISO / fractional CISO desk and you have at least one regulated SMB client who has asked an AI governance question in the last quarter — Cyber Savi is taking 10 design partners this month at no cost. Year of the Growth tier free across your book, naming on the launch page, direct line to the build team. Book 30 minutes at fantastical.app/toddmerrill/silverback-cto. GovernAI is co-built with Kirby Winters and the Cyber Savi Security team. Live now at governai.cloud. --- # Contact - Email: todd@silverbackcto.com - Booking: https://fantastical.app/toddmerrill/silverback-cto - LinkedIn: https://linkedin.com/in/toddmerrill - Substack: https://toddmerrill.substack.com - Podcast: Tales From The Sky Lounge — https://tftsl.podtosite.com