We said MAYBE on October 23, 2026. Not settled — due October 23, 2027.
Read this with the caveat. We tested the engine that produced this verdict against 292 launches whose outcomes we already knew, and could not show it predicted which survived. Some of its data sources were also dead at the time of scoring. The verdict stays up, dated and unedited, because a record you can quietly revise is not a record — but it is worth less than it looked when it was written.
Real commercial activity exists around agent security, but none of it is evidence that developers are searching for or paying for a third-party audit tool — the Reddit and keyword signals are career/educational noise, and all four competitors are large funded companies rather than proof that small teams win here. The identified gaps are plausible but are analyst-inferred, not quotes from frustrated paying users. This is a lean-SKIP unless the operator already has security domain credibility, in which case the open-source wedge is worth a cheap, time-boxed test.
Four real products are commercially invested in this space (NVIDIA, Visa, Datadog, LangChain), which proves budget exists — but the social and keyword channels show career-learner intent, not buyer intent, so the pull is one-channel at best.
A concrete wedge exists — an open-source, developer-priced agent audit checklist/scorecard that the enterprise incumbents ignore — but every named incumbent is a funded giant, and security tooling buyers trust brands and run procurement, which a solo founder cannot shortcut by shipping alone.
The axes land in lukewarm territory, but the best case for building is that this is an early market where the category-defining open-source artifact (an OWASP-style agent security checklist plus a scanner) has not been claimed, and whoever publishes it gets permanent distribution from every developer Googling 'is my agent safe'. NVIDIA and Visa are solving enterprise and payments problems, not the indie dev's problem, and a free OSS scanner is not something they will bother to ship. Against the build: the social evidence here is almost entirely people asking about security auditing as a *career*, which is a textbook false-positive signal, and security is the hardest category on earth to sell into with no name and no credentials.
What is worth more than this page. The register records what became of 14,962 real launches. No engine has to be right for that to be true.