Antigen growth playbook

In one week: unpublish the 65 template pages (or noindex them and drop them from llms.txt), then publish a small set of real replacements built from what the Enterprise and Government pages already say: Subprocessors (the actual vendors, with a change-notice process), DPA and MSA (how to request them), Data retention (30, 90 or custom days, on-demand purging, KMS encryption), Data location (what runs where for managed vs dedicated deployments), Engagement and plans (how a managed or dedicated engagement is scoped, even without prices), Support (dedicated expert, office hours) and Account and data deletion. Link each page from the Trust Center and the Enterprise page so diligence starts in the right place.

Security buyers read vendors' docs and legal pages before a demo, and AI assistants increasingly answer vendor-diligence questions from llms.txt. Removing placeholder legal text removes an easy reason to fail review, and real pages turn existing enterprise claims into something a reviewer can cite.

[ ] Subprocessors: real vendor list, purpose, region, change-notice window
[ ] DPA and MSA: how to request, standard terms
[ ] Data retention: 30 / 90 / custom days, on-demand purge, KMS encryption
[ ] Data location: managed vs dedicated (Helm chart or container image)
[ ] Engagement model: how scope, targets and approvals work
[ ] Support: dedicated expert, office hours, response times
[ ] Account and data deletion
[ ] Remove /docs/help template pages from llms.txt and navigation
[ ] Link all of the above from trust.antigen.sh and /enterprise

• Deleting pages breaks inbound links

  Redirect each removed URL to the closest real page.

• New legal pages overstate commitments

  Have counsel review the subprocessor and DPA pages before publishing.

• Your websiteDocs index llms.txt (checked November 9, 2026): 176 entries. About 110 are real product docs (Asset Map, Runs, tCell, SDK, CLI with CI/CD integration, a "Pentest after a deployment" example, 21 integrations including GitLab, Jira, ServiceNow, Cursor Cloud and Devin, and an API reference). The other 65 are a help center from a template: "Compare plans" describes "Free, Team, and Enterprise tiers for this demo help center"; "Subprocessors" is an "Illustrative list of subprocessors for this demo" naming none; "EU data residency options in this demo help center"; plus pages on editor drafts, projects, keyboard shortcuts and Salesforce and HubSpot connectors. The help-center home shows unrendered code.Source
• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source
• Your websiteGovernment page: "Security testing built for government boundaries"; dedicated on-premises deployment as a Helm chart or container image; SSO, SCIM and audit streaming to Splunk, Sentinel and others; support for GovRAMP and FISMA reporting work (stated as not a certification); mapping to NIST, CJIS, FERPA and CIRCIA; sectors: state and local government, public utilities and education; procurement through Pursuit, a public-sector reseller, plus cooperative purchasing.Source

Redirect /trust to trust.antigen.sh, fix the button, and add the Trust Center to the header or footer of the Government page and docs. On the Trust Center, state the SOC 2 Type II audit status plainly ("underway", with an expected report window), HIPAA, the DPA and MSA, and the new subprocessor page from idea 1. Add an automated link check to the site build so this cannot recur.

Enterprise and public-sector deals stall in security review; a working, complete Trust Center lets the champion forward one link instead of waiting on a questionnaire.

• SOC 2 timeline slips after it is published

  Give a window, not a date, and update it monthly.

• #1 Replace the 65 "demo help center" template pages in the docs with the real pages buyers check: subprocessors, DPA, retention and plans

• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source
• Your websiteTrust Center at trust.antigen.sh (run on Vanta) and a public status page at status.antigen.sh ("All systems operational"). The site's links include Docs, Blog, Trust Center, Status, X and LinkedIn; no newsletter signup was found.Source

Publish one sanitized write-up every two weeks on a finding class: how an attacker chains it, how tCell found it, the fix (as the pull request would look) and how the retest verified it. No customer names or identifying details. End each post with "Book a 30m demo" and a link to the sample report (idea 5). Share each on X and LinkedIn.

Security buyers trust vendors who show their work; rivals lead with research credibility. Posts on specific bug classes also match the searches engineers make when they worry about their own app.

• A post identifies a customer

  Strip details and get sign-off before publishing.

• Your websiteBlog (checked November 9, 2026): linked from the site and listed in the sitemap, it promises "Company updates, product thinking, and security research from the Antigen team" with filters for Product, Research, Company, Ideas and Customers, but shows 0 articles.Source
• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source

Ask three logo customers (ideally one technology, one healthcare, one public-sector-adjacent) for a 20-minute interview and publish short stories: what they used before, time to first validated finding, number of exploitable findings, median time from finding to verified fix, and one quote. Add one quote under the logo bar and link each story from the relevant industry page.

Peer proof shortens security buying, and numbers on time-to-verified-fix show the find-fix-verify loop that sets Antigen apart.

• Customers will not name security weaknesses publicly

  Publish aggregate numbers and outcomes, not vulnerabilities.

• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source
• Your websiteSitemap (checked November 9, 2026): 6 URLs in total: /, /blog, /enterprise, /government, /privacy and /terms, last updated in August 2026. No pricing, case study, comparison, healthcare or financial-services pages.Source

Run tCell against a deliberately vulnerable demo app you own, and publish the resulting report as an ungated web page and PDF: one critical chained finding with evidence, the remediation PR, the retest log that moved it to Verified, and the compliance mapping (CWE, PCI DSS, NIST). Link it from the homepage hero, the Enterprise page and every blog post.

It lets the champion show their team what they will receive, and makes the difference from a PDF-only point-in-time pentest concrete.

• Looks staged

  Say it is a demo app and show the raw logs.

• Your websiteQuick start: submit a target, which "the Antigen team reviews" for ownership or permission; connect AWS, Vercel or Okta with read-only access, or start with an external assessment; an Antigen expert plans the engagement and runs tCell; triage-agent and remediation-agent investigate and prepare fixes (pull requests with GitHub); after a fix is marked Remediated, tCell retests and moves it to Verified. Evidence includes HTTP requests and responses, screenshots or exploit recordings. No self-serve signup and no time estimate.Source
• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source

Publish /healthcare from the existing Enterprise copy: what the proposed rule would require (stated as proposed), how continuous testing plus verified fixes produces the evidence, which healthcare paths tCell tests (EHR-connected apps, FHIR APIs, patient portals), the dedicated deployment for PHI-sensitive environments, and a healthcare customer story (idea 4). Offer a "readiness review" as the demo framing.

A dedicated page ranks for healthcare-specific searches and gives health-tech champions something to forward to compliance teams.

• The rule changes or is withdrawn

  Lead with risk and evidence, not the deadline; update the page when HHS acts.

• #4 Turn seven logos into three short customer stories with numbers

• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source
• Industry researchHIPAA Security Rule proposed changes (NPRM): penetration tests at least every 12 months and vulnerability scans at least every six months for regulated entities; not final, with final action now projected for July 2027.Source
• Your websiteSitemap (checked November 9, 2026): 6 URLs in total: /, /blog, /enterprise, /government, /privacy and /terms, last updated in August 2026. No pricing, case study, comparison, healthcare or financial-services pages.Source

Publish /pricing that explains what drives price (number of targets or environments, managed vs dedicated deployment, testing frequency, the monthly human red-team assessment), what is always included (dedicated expert, retests, integrations, SSO and audit logs) and a "starting from" figure or typical range. Compare it plainly with the cost of two point-in-time pentests a year.

Pricing transparency filters out poor-fit leads and lets champions start budgeting before the demo, which shortens cycles.

• Anchors enterprise deals low

  Show a starting point for managed and "contact us" for dedicated.

• #1 Replace the 65 "demo help center" template pages in the docs with the real pages buyers check: subprocessors, DPA, retention and plans

• Your websiteSitemap (checked November 9, 2026): 6 URLs in total: /, /blog, /enterprise, /government, /privacy and /terms, last updated in August 2026. No pricing, case study, comparison, healthcare or financial-services pages.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source
• Your websiteDocs index llms.txt (checked November 9, 2026): 176 entries. About 110 are real product docs (Asset Map, Runs, tCell, SDK, CLI with CI/CD integration, a "Pentest after a deployment" example, 21 integrations including GitLab, Jira, ServiceNow, Cursor Cloud and Devin, and an API reference). The other 65 are a help center from a template: "Compare plans" describes "Free, Team, and Enterprise tiers for this demo help center"; "Subprocessors" is an "Illustrative list of subprocessors for this demo" naming none; "EU data residency options in this demo help center"; plus pages on editor drafts, projects, keyboard shortcuts and Salesforce and HubSpot connectors. The help-center home shows unrendered code.Source

Publish four pages: "Continuous vs point-in-time pentesting" (expanding the homepage table with a cost and coverage view), and fair comparisons with XBOW, Horizon3.ai NodeZero and Cobalt on what matters to Antigen's buyers: fixes delivered as pull requests, automatic retest, a dedicated human expert, self-hosted deployment and cross-tenant testing. Cite each rival's own site and date every page.

Comparison searches are late-stage and high intent, and the pages also shape how AI assistants describe Antigen against better-known names.

• Out-of-date claims about rivals

  Cite sources and date each page.

• Your websiteHomepage comparison: point-in-time pentesting means weeks of setup, a PDF report about two weeks later, patching left to your team and retesting 6-12 months later; continuous means easy onboarding, findings on a board in real time, pull requests opened by Antigen and immediate end-to-end retesting.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source
• Your websiteSitemap (checked November 9, 2026): 6 URLs in total: /, /blog, /enterprise, /government, /privacy and /terms, last updated in August 2026. No pricing, case study, comparison, healthcare or financial-services pages.Source

Package the existing example as a public GitHub Action (and GitLab CI template) listed in the GitHub Marketplace, with a README that shows a run starting after deploy and posting results to the pull request. Write a landing page and a blog post, and offer it as the default onboarding step for new customers.

Marketplace listings and repos are found by the engineers who will champion Antigen, and a pipeline hook makes Antigen part of every release, which raises retention.

• Runs triggered against unapproved targets

  Only run against targets Antigen has already approved.

• Your websiteDocs index llms.txt (checked November 9, 2026): 176 entries. About 110 are real product docs (Asset Map, Runs, tCell, SDK, CLI with CI/CD integration, a "Pentest after a deployment" example, 21 integrations including GitLab, Jira, ServiceNow, Cursor Cloud and Devin, and an API reference). The other 65 are a help center from a template: "Compare plans" describes "Free, Team, and Enterprise tiers for this demo help center"; "Subprocessors" is an "Illustrative list of subprocessors for this demo" naming none; "EU data residency options in this demo help center"; plus pages on editor drafts, projects, keyboard shortcuts and Salesforce and HubSpot connectors. The help-center home shows unrendered code.Source
• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source

Build one integration page per coding-agent tool showing the loop end to end (finding, hand-off, fix PR, retest, Verified), record a two-minute video, and pitch each tool's partnerships team for a joint post or integration-directory listing. Use the same story on the homepage remediation section.

Teams already using coding agents are the most likely to accept automated fixes, and partner directories send qualified traffic at no cost.

• Automated fixes worry security teams

  Lead with the required human approval before merge.

• #5 Publish a sample report so buyers can see a finding, its exploit and its retest before the demo

• Your websiteDocs index llms.txt (checked November 9, 2026): 176 entries. About 110 are real product docs (Asset Map, Runs, tCell, SDK, CLI with CI/CD integration, a "Pentest after a deployment" example, 21 integrations including GitLab, Jira, ServiceNow, Cursor Cloud and Devin, and an API reference). The other 65 are a help center from a template: "Compare plans" describes "Free, Team, and Enterprise tiers for this demo help center"; "Subprocessors" is an "Illustrative list of subprocessors for this demo" naming none; "EU data residency options in this demo help center"; plus pages on editor drafts, projects, keyboard shortcuts and Salesforce and HubSpot connectors. The help-center home shows unrendered code.Source
• Your websiteQuick start: submit a target, which "the Antigen team reviews" for ownership or permission; connect AWS, Vercel or Okta with read-only access, or start with an external assessment; an Antigen expert plans the engagement and runs tCell; triage-agent and remediation-agent investigate and prepare fixes (pull requests with GitHub); after a fix is marked Remediated, tCell retests and moves it to Verified. Evidence includes HTTP requests and responses, screenshots or exploit recordings. No self-serve signup and no time estimate.Source

Create one kit per sector: a two-page overview, the security and deployment summary (dedicated on-premises option, SSO, SCIM, audit streaming), control mappings (NIST, CJIS, FERPA, CIRCIA as the page states), a sample report (idea 5), an accessibility statement (idea 18) and standard procurement answers. Host the kits on the Government page behind a simple request form, and train the reseller's team in a 30-minute session.

Public-sector cycles are long and document-driven; a kit lets the reseller and the champion move without waiting on a five-person team.

• Mappings read as certifications

  Keep the page's own wording: support, not authorization.

• #5 Publish a sample report so buyers can see a finding, its exploit and its retest before the demo

• Your websiteGovernment page: "Security testing built for government boundaries"; dedicated on-premises deployment as a Helm chart or container image; SSO, SCIM and audit streaming to Splunk, Sentinel and others; support for GovRAMP and FISMA reporting work (stated as not a certification); mapping to NIST, CJIS, FERPA and CIRCIA; sectors: state and local government, public utilities and education; procurement through Pursuit, a public-sector reseller, plus cooperative purchasing.Source

Add a one-click export per framework: scope, test dates, findings mapped to controls, remediation PRs and retest evidence, signed by the assigned Antigen expert. Market it as "your pentest evidence, always current" on a compliance page, and show a redacted sample.

Compliance budgets are reliable, and a pack that replaces the annual pentest letter turns continuous testing into something the audit team asks to renew.

• Auditors reject automated evidence

  Include the human expert's review and signature.

• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source
• Your websiteQuick start: submit a target, which "the Antigen team reviews" for ownership or permission; connect AWS, Vercel or Okta with read-only access, or start with an external assessment; an Antigen expert plans the engagement and runs tCell; triage-agent and remediation-agent investigate and prepare fixes (pull requests with GitHub); after a fix is marked Remediated, tCell retests and moves it to Verified. Evidence includes HTTP requests and responses, screenshots or exploit recordings. No self-serve signup and no time estimate.Source

Instrument the onboarding path: contract signed, target submitted, target approved, first run started, first validated finding. Find the slowest step (usually target approval or access), add a same-day approval commitment and a pre-filled scope template, and then publish the median on the homepage and in sales decks.

A fast first finding is the moment a new customer sees value; measuring it shortens onboarding and gives sales a credible, specific claim.

• Dedicated deployments are much slower

  Publish separate numbers for managed and dedicated.

• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source
• Your websiteQuick start: submit a target, which "the Antigen team reviews" for ownership or permission; connect AWS, Vercel or Okta with read-only access, or start with an external assessment; an Antigen expert plans the engagement and runs tCell; triage-agent and remediation-agent investigate and prepare fixes (pull requests with GitHub); after a fix is marked Remediated, tCell retests and moves it to Verified. Evidence includes HTTP requests and responses, screenshots or exploit recordings. No self-serve signup and no time estimate.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source

Send each customer a one-page monthly summary, written with their expert: exploitable paths closed and retested, median time from finding to verified fix, new attack surface discovered, and the human red-team highlights. Make it easy to forward to a CISO, CTO or board, and use the trend in renewal conversations.

Security tools are renewed when leadership can see risk going down; a forwardable summary puts Antigen in front of the budget owner every month.

• Summaries reveal sensitive details when forwarded

  Keep the forwardable version to counts and trends.

• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source
• Y CombinatorY Combinator profile: Fall 2025 batch, team of 5, San Francisco; backed by Lightspeed, DST Global and Susa Ventures. Describes "an AI adversary" that tests the attack surface nightly plus "monthly human red team assessments", with customers in "financial services, healthcare, retail, and government".Source

Offer customers an opt-in badge and a short verification page ("Continuously tested since <month>, last retest <date>") they can link from their trust center or security page, showing no findings. Each badge links back to Antigen. Pair it with a customer referral credit.

It turns customers' security reviews into Antigen's distribution: the people reading are exactly the next buyers.

• A badge implies a guarantee

  State what it means: tested continuously, not "secure".

• Your websiteTrust Center at trust.antigen.sh (run on Vanta) and a public status page at status.antigen.sh ("All systems operational"). The site's links include Docs, Blog, Trust Center, Status, X and LinkedIn; no newsletter signup was found.Source
• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source

Once a month, publish a short research note: one attack chain the agent completed, one where it stalled, what the human expert did, and what changed in the agent afterwards. Use the job post's language in the hiring pitch too: the research notes become the best recruiting material for the next researcher.

Candor about limits builds trust with security practitioners, makes the human-in-the-loop model concrete, and gives the empty blog a steady research series.

• Competitors use the limits against Antigen

  Always pair a limit with the fix and the human step that covers it.

• #3 Fill the empty blog with sanitized write-ups of real finding types, starting with cross-tenant access

• HiringSecurity Researcher (San Francisco, $150K-$220K, 0.5%-1.0% equity), the one open role: an "expert-in-the-loop" who deploys tCell into real environments, watches "how the agent chains attacks and where it gets stuck", and turns that into research that improves the agent.Source
• Your websiteBlog (checked November 9, 2026): linked from the site and listed in the sitemap, it promises "Company updates, product thinking, and security research from the Antigen team" with filters for Product, Research, Company, Ideas and Customers, but shows 0 articles.Source

Publish /financial-services (audit trails, data retention, PCI DSS mapping, dedicated deployment) and /retail (checkout, loyalty and customer-account takeover paths, PCI DSS mapping), each with a relevant finding write-up and a customer quote. Add both to the homepage industry tiles.

Industry pages rank for vertical searches and let champions forward something that speaks their regulator's language.

• Thin pages

  Publish only with a real write-up and quote.

• Y CombinatorY Combinator profile: Fall 2025 batch, team of 5, San Francisco; backed by Lightspeed, DST Global and Susa Ventures. Describes "an AI adversary" that tests the attack surface nightly plus "monthly human red team assessments", with customers in "financial services, healthcare, retail, and government".Source
• Your websiteSitemap (checked November 9, 2026): 6 URLs in total: /, /blog, /enterprise, /government, /privacy and /terms, last updated in August 2026. No pricing, case study, comparison, healthcare or financial-services pages.Source

Fix the aria values and contrast on the homepage, run the same check on the Enterprise and Government pages and the platform's main screens, and publish a short accessibility statement (and a VPAT when asked) linked from the Government page and the procurement kit (idea 11).

Removing a small procurement blocker is cheap, and the speed advantage is already there.

• Design changes

  Adjust shades, not the palette.

• PageSpeedHomepage, Google PageSpeed (November 2026): mobile performance 97, desktop 100, SEO 100, accessibility 92 with two issues (invalid aria attribute values and low colour contrast). Real visitors pass Core Web Vitals: LCP 1.16 s, INP 73 ms, CLS 0 at the 75th percentile.Source
• Your websiteGovernment page: "Security testing built for government boundaries"; dedicated on-premises deployment as a Helm chart or container image; SSO, SCIM and audit streaming to Splunk, Sentinel and others; support for GovRAMP and FISMA reporting work (stated as not a certification); mapping to NIST, CJIS, FERPA and CIRCIA; sectors: state and local government, public utilities and education; procurement through Pursuit, a public-sector reseller, plus cooperative purchasing.Source

Build a gated-by-verification external check: the prospect verifies a domain, tCell maps the external surface and runs a small set of safe, non-destructive checks, and an expert reviews the top findings within 48 hours. The result is a short report with one or two validated issues and an offer for the full engagement. Hard limits on scope, rate and techniques; nothing runs against unverified targets.

A real finding about the buyer's own system is the most persuasive demo possible, and it creates qualified pipeline from engineers who would never book a sales call first.

• Abuse against third parties

  Verified ownership only, strict limits and manual approval for the pilot.

• Expert time does not scale

  Cap weekly checks and prioritize by company fit.

• Your websiteQuick start: submit a target, which "the Antigen team reviews" for ownership or permission; connect AWS, Vercel or Okta with read-only access, or start with an external assessment; an Antigen expert plans the engagement and runs tCell; triage-agent and remediation-agent investigate and prepare fixes (pull requests with GitHub); after a fix is marked Remediated, tCell retests and moves it to Verified. Evidence includes HTTP requests and responses, screenshots or exploit recordings. No self-serve signup and no time estimate.Source
• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source

Publish an annual, anonymized and aggregated report: finding classes by industry, share found between releases, median days from finding to verified fix with and without automated PRs, and what the human red team found that the agent missed. Release it with a webinar and use the charts in sales and the comparison pages.

Original data earns press, links and analyst attention, and it makes the find-fix-verify loop measurable in public.

• Small sample

  Report ranges, state sample size, and add more each year.

• #3 Fill the empty blog with sanitized write-ups of real finding types, starting with cross-tenant access

• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source
• Y CombinatorY Combinator profile: Fall 2025 batch, team of 5, San Francisco; backed by Lightspeed, DST Global and Susa Ventures. Describes "an AI adversary" that tests the attack surface nightly plus "monthly human red team assessments", with customers in "financial services, healthcare, retail, and government".Source

Scope which deployment needs which authorization: the managed SaaS for GovRAMP, the dedicated deployment for agency-hosted use. Finish SOC 2 Type II first, then engage an assessor for the GovRAMP path with one or two design-partner agencies through the reseller. Publish the status on the Trust Center as it progresses.

Authorization is a durable moat in public-sector sales and unlocks larger, multi-year contracts that fit continuous testing.

• Distracts a five-person team

  Only start with a committed design partner.

• #2 Fix the Enterprise page's Trust Center button (it returns 404) and put the Trust Center on every page
• #11 Give the public-sector reseller a ready-to-forward procurement kit for each sector

• Your websiteGovernment page: "Security testing built for government boundaries"; dedicated on-premises deployment as a Helm chart or container image; SSO, SCIM and audit streaming to Splunk, Sentinel and others; support for GovRAMP and FISMA reporting work (stated as not a certification); mapping to NIST, CJIS, FERPA and CIRCIA; sectors: state and local government, public utilities and education; procurement through Pursuit, a public-sector reseller, plus cooperative purchasing.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", 200+ security teams, #1 on HackerOne, a Pricing page, free unlimited re-testing, SOC 2, ISO 27001 and ISO 42001; Horizon3.ai NodeZero, "Go hack yourself. Before they do.", 7,012 customers, a NodeZero Federal offering, 4.7 on Gartner Peer Insights; Cobalt, "Continuous Offensive Security Testing" with 500+ vetted testers, a usage-based credit model and a downloadable State of Pentesting 2026 report.See the research Source
• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source

Launch a startup track: a fixed-scope managed engagement for seed to Series A companies, connected through the startup-stack integrations, with a pentest letter for their first enterprise security review and continuous testing after. Distribute it through accelerator perks programs and founder communities, and publish a "pentest before your first enterprise deal" guide.

Startups decide fast, grow into larger contracts, and become the logo wall; the integrations to win them already exist.

• Expert time spent on small accounts

  Fixed scope and capped expert hours.

• Your websiteHomepage integrations: Amazon Web Services, Railway, Vercel, Astro, Clerk, Okta, GitHub, Linear, n8n, Tailscale and Supabase, connected to build a live map of exposed assets.Source
• Your websiteHomepage (checked November 9, 2026): H1 "Antigen is the defense factory that maps, exploits, and secures your entire attack surface." The offensive agent tCell chains exploits; "Every finding arrives with a reproducible exploit attached"; Antigen opens pull requests and retests each fix. Each customer gets "a dedicated security expert" and every report is reviewed by a researcher. Managed deployment: "Run your first pentest in under 30 minutes"; dedicated self-hosted workers on AWS, Azure, GCP or Kubernetes. Seven customer logos (Antimetal, Enzo Health, Orkes, Harper, Retell AI, Pursuit, Faye) and no written testimonials; industries listed: Technology, Financial Services, Healthcare, Government; no pricing; the only conversion path is "Book a 30m demo" on Cal.com. The sample board lists findings such as cross-tenant report access, an unsigned webhook endpoint, over-scoped CI tokens and sessions that stay valid after workspace removal.Source
• Y CombinatorY Combinator profile: Fall 2025 batch, team of 5, San Francisco; backed by Lightspeed, DST Global and Susa Ventures. Describes "an AI adversary" that tests the attack surface nightly plus "monthly human red team assessments", with customers in "financial services, healthcare, retail, and government".Source

Build a partner program for audit firms, compliance-automation partner networks and vCISO firms: a partner page, a referral fee or client discount, the evidence pack (idea 12) formatted for auditors, and a quarterly partner briefing. Start by asking Antigen's own SOC 2 auditor and compliance platform how their clients currently source pentests.

Partners recommend at the moment of need, and continuous testing with verified fixes makes their audits easier, so the referral helps both sides.

• Auditor independence concerns

  Keep referrals separate from the audit relationship and disclose any fees.

• #12 An audit-ready evidence pack per framework, exported straight from verified findings

• Your websiteTrust Center at trust.antigen.sh (run on Vanta) and a public status page at status.antigen.sh ("All systems operational"). The site's links include Docs, Blog, Trust Center, Status, X and LinkedIn; no newsletter signup was found.Source
• Your websiteEnterprise page: "Continuous offensive security without giving up control." HIPAA compliant; "An independent SOC 2 Type II audit is underway"; compliance-mapped findings for PCI DSS, NIST 800-171, ISO 27001 and CWE; procurement documents (DPA, MSA, security questionnaire responses, a named security contact); 30-day, 90-day or custom retention; 12 integrations including Jira, ServiceNow, Splunk and Tenable; a healthcare section on the proposed HIPAA Security Rule's annual penetration-testing requirement. Its "Visit the Trust Center" button links to antigen.sh/trust, which returned 404 Not Found on two checks on November 9, 2026; the Trust Center itself lives at trust.antigen.sh.Source