Exception OS for regulated AWS teams that turns architecture-review deviations into enforceable controls, approvals, and live audit proof.

1. Dawnguard's launch claim that architecture can be turned into enforceable code shows the market is shifting from post-deployment cloud scanning toward design-time control enforcement.
2. Forbes explicitly frames regulated businesses as the target buyer for secure and compliant cloud architecture by design, confirming a segment where this pain is mandatory rather than optional.
3. About 15 large organizations already running design partnerships is strong evidence that enterprises will change architecture-review workflows now if it helps them ship safely.
4. Fresh capital, total funding above €5.5 million, and a New York plus U.S. go-to-market push indicate that founders and investors see an immediate commercial opening in regulated cloud-security workflows.

Catalyst. Dawnguard's public launch, 15 design partners, and push into regulated U.S. buyers show that secure-by-design cloud architecture has become a live budget category, making exception governance an immediate pain rather than a future feature request.

The startup plugs into architecture decision records, Jira requests, Backstage service catalogs, and Terraform plans to detect where a proposed design deviates from the bank's approved patterns. It generates an exception packet with the exact control gaps, required compensating controls, approvers, expiry window, and implementation tasks for engineers. After approval, it links the exception to IaC and runtime checks so the control promises are continuously verified instead of disappearing into tickets. Security leaders get a live map of active deviations, renewal deadlines, and repeat exception patterns that should become new golden paths. Over time, the company builds the highest-value dataset in the category: which exceptions are common, which controls actually contain them, and which teams create the most audit drag.

What's different. CSPM and IaC tools tell teams what violates policy, but they do not manage the pre-deployment negotiation over whether a deviation is acceptable, what compensating controls it needs, or when it should expire. GRC systems store risk acceptances, yet they are disconnected from Terraform, service catalogs, and runtime proof. This company owns the missing lifecycle from proposed architecture deviation to enforced control state, and its moat deepens as it learns which exception patterns regulated enterprises approve repeatedly and under what safeguards.

Jobs to be done

flowchart LR
  Buyer[Chief Architect] --> Pain[Manual cloud design exceptions]
  Pain --> Product[Cloud Design Exception OS]
  Product --> Outcome[Faster releases with enforceable audit proof]

Executive takeaways

• The credible wedge is not another scanner; it is the approval-and-evidence layer that sits between native cloud guardrails and manual review boards.
• Budget already exists in adjacent categories such as secure cloud adoption programs, ITSM change control, CSPM/CNAPP, and policy-as-code tooling.
• The best initial market is AWS-heavy regional banks and specialty insurers where cloud exceptions are already governance, audit, and release-velocity problems.
• Competition is intense in adjacent layers, but most incumbents stop at detection, policy enforcement, or ticketing rather than owning the full exception lifecycle.
• The hardest adoption problem is trust and integration, not raw detection; buyers must believe the system speeds approvals without weakening accountability.

Market definition

U.S. enterprise software for governing pre-deployment cloud architecture exceptions in regulated environments, initially focused on AWS-heavy regional banks and specialty insurers. The product scope is narrow: intake, risk assessment, approval workflow, compensating-control mapping, and continuous proof that approved deviations remain bounded.

Customer and buyer

Primary users are principal security architects, chief architects, and cloud platform leaders who run architecture review boards and own policy guardrails. The economic buyer is usually the CISO, Head of Cloud Platform, or Chief Architect because the problem spans release velocity, cloud risk, and audit evidence.

Buying triggers

• A new workload, AI feature, or third-party integration needs a non-standard IAM, data-flow, or network pattern, turning native guardrails into an approval bottleneck. [1][13][43][57][64]
• Audit and examination readiness requires durable proof that approved deviations remain monitored, bounded, and time-limited rather than living only in documents. [21][23][24][26][51]
• Teams want to replace slow, document-heavy change boards with policy-aware workflows that preserve auditability and ownership context. [5][71][93][94]

Willingness to pay

Willingness to pay is credible because buyers already spend on adjacent control layers that map directly onto the wedge: cloud posture tooling, audit-evidence automation, IaC policy enforcement, and ITSM change management. A startup that shortens the path to an approved exception while preserving proof can reallocate from those existing budgets instead of inventing a speculative new AI line item. [51][58][82][89][93][98]

Category dynamics

Growth signal 16% CAGR

Validation signals

• Dawnguard says it moved from enterprise design partnerships into general availability, indicating buyers will experiment with the category now.
• Treasury and FSSCC published explicit secure-cloud and secure-by-design materials for financial institutions, validating executive attention.
• AWS, Azure, and Google Cloud all expose native policy and audit primitives, making third-party exception orchestration technically feasible.
• Terraform, Sentinel, and OPA show that policy-as-code is already operationally mature in cloud delivery workflows.

Regulatory & technical constraints

• Approved exceptions must preserve secure-development, configuration-control, and continuous-monitoring evidence.
• The product has to map approvals into provider-specific policy models such as AWS SCPs, Azure Policy exemptions, and Google Cloud organization policies.
• Financial-services cloud adoption brings third-party oversight, transparency, and monitoring expectations into the deployment process.
• Insurance buyers add sector-specific cybersecurity scrutiny that can lengthen onboarding diligence.

Competition is fragmented across cloud-native guardrails, CNAPP/CSPM, IaC orchestration, and ITSM workflow tools. The open space is a narrow system of record for cloud design exceptions that links a business justification to compensating controls, expiry logic, and live evidence in the underlying cloud stack.

Why incumbents do not win by default

• Cloud provider governance suites. AWS, Azure, and Google Cloud already offer guardrails, policy constraints, exemptions, and audit telemetry, but they do not by default own the cross-functional approval graph or renewal workflow for exceptions.
• IaC policy and orchestration. Terraform, Sentinel, OPA, and Spacelift are strong at enforcing policy in delivery pipelines, but they are not the system of record for architecture-review intake, business justification, or evidence-led renewals.
• CNAPP and CSPM platforms. Prisma-class and Snyk-class tools move left and provide posture visibility, yet they still center on misconfigurations, vulnerabilities, and policy checks rather than the human process of deciding when a deviation is acceptable.
• ITSM and exception-management workflows. Jira Service Management and formal risk-acceptance processes can capture approvals and audit history, but they remain generic workflow layers unless heavily wired into cloud policy and runtime proof.
• In-house review boards. Manual review remains flexible and familiar, but the fetched material shows why it becomes process-heavy, slow, and hard to connect to live cloud state as volume grows.

Regulated AWS teams already turn architecture into enforceable code, but the scarce resource is now the exception layer: the negotiation over which non-standard data flow, IAM role, or vendor integration is acceptable, what compensating control bounds it, and whether that control is still true in production months later. We start with a narrow wedge — a cloud design exception OS for U.S. regional banks and specialty insurers running 10-50 AWS squads with a formal weekly architecture review board — because that segment already has Terraform-based golden paths, recurring exception volume, and audit deadlines that make the pain unavoidable rather than optional. The product ingests architecture proposals, Jira tickets, and Terraform plans, diffs them against approved patterns, and produces an exception packet with required compensating controls, named approvers, and an expiry date, then keeps proving the deviation is still bounded after deployment. Dawnguard's July 2026 launch, 15 design partners, and U.S. expansion validate that secure-by-design cloud budget exists now, but research shows Dawnguard and adjacent CNAPP, IaC, and ITSM vendors stop at detection, policy enforcement, or generic ticketing rather than owning the full approval-to-enforcement lifecycle with a durable evidence chain. Research-derived market sizing puts TAM near $58M, SAM near $20M (roughly 80 AWS-heavy regional banks and insurers with formal review boards), and a reachable three-year SOM of $4.8M across 16 logos at a blended ~$300k ACV — a real but genuinely niche wedge, not a venture-scale market on its own, so the plan is explicit that expansion into broader architecture governance and multi-cloud policy is required to justify a venture return. The near-term goal is not category dominance; it is proving that one design partner can cut exception cycle time and pass an internal-audit walkthrough using live evidence instead of screenshots. The biggest open question the research could not answer is exact backlog volume and cycle time per institution, so the first 90 days are structured around getting that data directly from design partners before committing to a broader integration roadmap. Funding is scoped as a pre-seed round sized to prove this narrow claim with 2-3 paying design partners, not to build a multi-cloud platform.

Problem

• Security architects at regulated banks and insurers manually review architecture deviations in Confluence decks and Jira tickets, with no system tying the approved exception to the compensating control an engineer actually implements in Terraform or runtime policy.
• Approved deviations expire silently — auditors and examiners discover "accepted" risk was never enforced in production, forcing release freezes or emergency remediation instead of a routine renewal.

Solution

• Ingest architecture decision records, Jira requests, Backstage catalog entries, and Terraform plans to detect where a proposed design deviates from the institution's approved reference patterns.
• Generate an exception packet naming the control gap, required compensating controls, approvers, and expiry window, then link the approved exception to IaC and runtime checks so the control promise is continuously verified rather than filed away.

Why we win

• The approval-to-enforcement lifecycle (intake → risk assessment → compensating control → expiry → live proof) is not owned end-to-end by any named competitor; Dawnguard, AWS native governance, Spacelift, Prisma Cloud, and Jira Service Management each cover one segment of it, per research's competitive landscape and incumbentThesis analysis.
• A proprietary graph of which exception types get approved, under what compensating controls, and how often they drift or expire becomes harder for generic scanners or ticketing tools to replicate the longer we run it, per research's dataMoats analysis.

Milestones

flowchart LR
  Wedge[AWS-heavy bank/insurer exception backlog] --> MVP[Exception-packet MVP: ticket + Terraform diff]
  MVP --> Proof[Design-partner cycle-time and audit evidence proof]
  Proof --> Expansion[Bidirectional sync, auditor workspace, multi-cloud expansion]

Founding team

Experiment roadmap

Risk assessment

What must be true

• Target institutions process at least 10+ recurring architecture exceptions per quarter that create measurable release delay or audit risk.
• The economic buyer (CISO/Chief Architect/Head of Cloud Platform) will reallocate existing CNAPP/ITSM/GRC budget rather than requiring new incremental spend approval.
• Internal audit teams will accept linked runtime evidence (Config/Audit Manager-style proof) in place of manual screenshot-based evidence packs within two pilot cycles.
• A pilot can demonstrably cut exception approval cycle time or improve the percentage of exceptions with implemented controls within one quarter, without requiring deep bidirectional Terraform/Backstage integration on day one.
• At least 2 of the first 5 target accounts convert a scoped pilot into an annual contract within 6 months of first contact.

Open diligence questions

• What is the actual quarterly volume of architecture exceptions, renewals, and expired approvals at 5-8 named target accounts, and how was it obtained?
• Which budget line will fund this — cloud platform, security architecture, or GRC/ITSM — and has that owner been directly validated as the first signer?
• How does the reference-pattern library get built for a new customer, and how many weeks of professional services does onboarding realistically require?
• What specifically differentiates this from Dawnguard's broader secure-by-design platform if Dawnguard adds exception-tracking features?
• Has any internal-audit team agreed, even informally, to accept automated evidence in place of manual packs, or is this still a hypothesis?
• Is AWS-only sufficient for the first 24 months, or will target design partners demand Azure/GCP parity before signing?

Model sanity

• Revenue engine. Base revenue is driven by moving from 3 paying accounts at Y1 exit to 16 by Q4Y3 while blended annual value per account approaches the researched ~$300K SOM level.
• Must go right. Paid pilots must convert to annual contracts in about one quarter and the first audit walkthrough must accept linked evidence, or the narrow wedge will not support the Q2Y2 milestone.
• Model breaks if. If conversion stretches toward 150 days or onboarding stays bespoke enough to cap gross margin near 70%, the downside case pushes the cash floor toward roughly $0.1M before seed proof is reached.
• Next-round proof. The seed story is 5 paying logos and 2-3 annual-contract conversions by roughly Q2Y2 plus evidence that auditors will accept the platform's live proof without reverting to screenshots.

Scenarios

Sensitivity

flowchart LR
  TargetAccounts[Target banks and insurers] --> DesignPartners[Qualified design partners]
  DesignPartners --> PaidPilots[Paid pilots]
  PaidPilots --> AnnualContracts[Annual contracts]
  AnnualContracts --> Modules[Onboarding and auditor workspace]
  Modules --> Revenue[Revenue]
  Revenue --> GrossProfit[Gross profit]
  GrossProfit --> Cash[Cash and runway]

Flags: The year-3 base case captures 16 of roughly 80 SAM accounts, so the model assumes unusually strong execution inside a concentrated buyer pool. · CustomersEop includes paid pilots and annual contracts, so recurring-only production logos lag the headline count through most of Y1 and early Y2. · Gross margin reaches the 75% target only if onboarding and evidence mapping become repeatable; prolonged bespoke work would compress EBITDA materially. · The wedge is intentionally niche, so adjacent expansion beyond AWS-heavy exception governance is still required after year 3 to justify venture-scale outcomes. · Cash is modeled as EBITDA; deferred onboarding payments, implementation prepayments, or compliance capex could shift actual cash timing.

• Policy trust gap. Security leaders may not trust software-generated compensating controls enough to approve sensitive exceptions through a new system. Mitigation: Start with human-in-the-loop recommendations on one cloud and a few high-volume exception types, while importing the customer's own reference patterns and evidence rules.
• Integration drag. Messy Jira, Backstage, Terraform, and architecture-document workflows could make deployment slower than the release bottlenecks the product is supposed to fix. Mitigation: Land first as a thin exception packet and Terraform-plan layer for teams that already use centralized review boards, then deepen integrations only after proving cycle-time savings.
• Incumbent feature creep. CSPM, IaC policy, or enterprise-architecture vendors could add basic exception tracking once the category gets more attention. Mitigation: Differentiate on the full approval-to-enforcement lifecycle and the approved-deviation dataset, while integrating with detection vendors instead of trying to replace them.