Subimage growth playbook

Publish one page on subimage.io for teams already running Cartography. It should cover: what they keep (the open schema, their Cypher queries and rules, and a self-hosted option); what they stop doing (syncs, Neo4j operations, manual correlation); what Subimage adds (the pricing-page list: prioritization, vulnerability management, attack paths, the investigation agent, RBAC and SSO, history); Corelight's day-a-week saving; and a short calculator (engineer days a week × salary). One day a week at a $170K–$230K engineering salary, Subimage's own hiring range, is about $34K–$46K a year before database hosting. The call to action is a free two-week side-by-side trial on the visitor's own read-only cloud account, booked through a dedicated Cal.com event. Link the page from the pricing table, the homepage's Cartography link and the Corelight story. Keep the CNCF repository and docs vendor-neutral. The page lives on Subimage's site, not in the project. Upside: 70+ known production teams, each already past the hardest adoption step. If one in ten tries the managed version, that is seven qualified trials from one page.

These teams have already proven the need and learned the model. The remaining objection is cost against effort, and Corelight's own numbers answer it. A page built for them also captures searches like "cartography managed" or "cartography neo4j production" that today go nowhere.

H1: You already run Cartography. Stop running the infrastructure.
1. What you keep: the open schema, your Cypher queries and rules, a self-hosted option
2. What you stop doing: syncs, Neo4j operations, manual correlation
3. What you add: prioritized Issues, attack paths, vulnerability management, the investigation agent, RBAC and SSO, history
4. Proof: Corelight, a full engineering day each week eliminated
5. Calculator: engineer days a week x salary = yearly cost
6. Migration in four steps: read-only roles, parallel sync, compare, switch
7. CTA: free two-week side-by-side trial

• The community sees the open-source project as a sales funnel

  Keep promotion off the CNCF repository and docs, and keep contributing upstream as before.

• Adopters stay on free because it works well enough

  Lead with the features they can't build cheaply: prioritization, attack paths and history.

• Your websiteFunding post (October 20, 2025): "We've raised $4.2M"; Cartography was built at Lyft in 2019 and "more than 70 companies have adopted it in production"; the team spent seven months "heads-down building with our early customers".Source
• Cartography projectCartography repository: 4.2k stars, 605 forks, Apache-2.0 licence. The README's "Who uses Cartography?" list names eight organizations (Lyft, Thought Machine, MessageBird, Cloudanix, Corelight, SubImage, Superhuman, Hadrian) plus "{Your company here}"; beyond that list it does not mention a managed version.Source
• Your websiteCorelight case study (July 22, 2026): alerts needed 30 to 60 minutes of manual context; Corelight's self-managed security graph took "a full day of engineering each week"; triage fell to minutes; Corelight's triage agent chose Subimage for 20% of about 2,000 autonomous tool calls, twice the next tool, out of about 30 tools ("My agent is deciding to use your tool the most, by far"); the page ends without a call to action.Source
• Your websitePricing page: "One price, unlimited usage." with no published prices or tiers; price depends on "environment size, complexity, and deployment goals"; "We can set up a trial at no cost."; self-hosting: "Reach out for details"; a table compares Subimage with open-source Cartography (only Subimage has managed operation, issue prioritization, vulnerability management, attack paths, an investigation agent, RBAC and SSO, and historical data); the only button is "Request pricing", which opens Cal.com; no FAQ.Source
• HiringFounding Engineer (YC jobs, San Francisco, $170K-$230K): open problems include whether vulnerabilities are reachable ("Are the vulns on internet-facing assets?"), verifying agent-proposed fixes, a near-real-time map, resource ownership, tracking compliance processes and adding "time travel" to replay attacks; stack: Cartography, Neo4j, Python/FastAPI, Svelte with WebGL, an MCP server; "a seed stage company (a mighty team of 3!)"; Cartography is used by "over 70 companies" including "7 in the Fortune 100".Source

Add a closing block to each case study: a one-line result, "See this on your own environment" with the trial booking, and a link to the other story. Create /customers listing both stories plus the named logos, each with a one-line use case. Link /customers from the homepage logo strip and the main navigation.

Readers who finish a case study are the most qualified visitors on the site. A next step at that moment turns reading into booking.

• Logo customers don't want a public use-case line

  Ask each one; list the logo alone where they decline.

• Your websiteVeriff case study (January 20, 2026): tens of thousands of containers and 600+ repositories; a proof of concept with traditional tools showed "seven million vulnerabilities"; with Subimage, React2Shell exposure across 600-700 packages was cleared in minutes instead of days; the graph made attack paths easier to explain to non-technical executives; the page ends without a call to action.Source
• Your websiteCorelight case study (July 22, 2026): alerts needed 30 to 60 minutes of manual context; Corelight's self-managed security graph took "a full day of engineering each week"; triage fell to minutes; Corelight's triage agent chose Subimage for 20% of about 2,000 autonomous tool calls, twice the next tool, out of about 30 tools ("My agent is deciding to use your tool the most, by far"); the page ends without a call to action.Source
• Your websiteSitemap (22 URLs, checked November 9, 2026): homepage, modules, five product pages (explorer, vulnerability management, attack path analysis, CSPM, CIEM), pricing, support, mission, four trust pages, the blog and seven posts; the newest post is dated July 22, 2026. No customers index, no comparison pages, no per-integration pages and no page for Cartography users.Source

Put the number and the quote ("My agent is deciding to use your tool the most, by far") on the homepage's Agents & MCP section, the MCP docs page and the skills site. Write a short technical post on why agents prefer graph context, with the tool-call breakdown, as the canonical source.

Every security team is now building triage agents. Proof that a real agent chose this tool over 29 others is more persuasive than any feature claim.

• One customer's agent may not generalise

  State it as one team's result and invite others to compare.

• Your websiteCorelight case study (July 22, 2026): alerts needed 30 to 60 minutes of manual context; Corelight's self-managed security graph took "a full day of engineering each week"; triage fell to minutes; Corelight's triage agent chose Subimage for 20% of about 2,000 autonomous tool calls, twice the next tool, out of about 30 tools ("My agent is deciding to use your tool the most, by far"); the page ends without a call to action.Source
• Your websiteHomepage: H1 "Subimage: The Open-Core Security Graph" and tagline "See what's exposed. Trace what it can reach.", "from the team behind Cartography"; customer names Veriff, Corelight, LangChain, Neo4j, Bree, Kontigo and Osmosis but no customer quotes; hourly read-only scans, on-prem or cloud; findings routed to Linear, Jira, Slack, webhooks or MCP; both main buttons ("Book a demo" and "Get started") open the same Cal.com booking page; the only social link is GitHub.Source
• Your websiteSkills site: two free plugin sets for coding agents: subimage-setup (connect-aws, connect-gcp, connect-azure, connect-kubernetes-outpost, connect-github, connect-declarative-schema; "no SubImage tenant connection is needed" to generate the setup code) and subimage-mcp (14 investigation skills such as triage-new-findings and investigate-cve); no sign-up or trial prompt.Source

Make "Start a free trial" a separate button on the homepage, pricing and product pages. It opens a short trial request (cloud provider, account count, preferred start), then a 20-minute setup call, with the connect-aws or connect-gcp skill linked so the read-only role can be ready before the call. Keep "Book a demo" for buyers who want a walkthrough.

Security engineers trust their own environment more than a demo, and the setup skills already remove most of the work.

• More small trials than the team can support

  Qualify by account count in the form.

• Your websitePricing page: "One price, unlimited usage." with no published prices or tiers; price depends on "environment size, complexity, and deployment goals"; "We can set up a trial at no cost."; self-hosting: "Reach out for details"; a table compares Subimage with open-source Cartography (only Subimage has managed operation, issue prioritization, vulnerability management, attack paths, an investigation agent, RBAC and SSO, and historical data); the only button is "Request pricing", which opens Cal.com; no FAQ.Source
• Your websiteHomepage: H1 "Subimage: The Open-Core Security Graph" and tagline "See what's exposed. Trace what it can reach.", "from the team behind Cartography"; customer names Veriff, Corelight, LangChain, Neo4j, Bree, Kontigo and Osmosis but no customer quotes; hourly read-only scans, on-prem or cloud; findings routed to Linear, Jira, Slack, webhooks or MCP; both main buttons ("Book a demo" and "Get started") open the same Cal.com booking page; the only social link is GitHub.Source
• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source
• Your websiteSkills site: two free plugin sets for coding agents: subimage-setup (connect-aws, connect-gcp, connect-azure, connect-kubernetes-outpost, connect-github, connect-declarative-schema; "no SubImage tenant connection is needed" to generate the setup code) and subimage-mcp (14 investigation skills such as triage-new-findings and investigate-cve); no sign-up or trial prompt.Source

Add a short FAQ: what sets the price (for example accounts, workloads or integrations, whichever is true), what "unlimited" includes (users, modules, queries, MCP calls), fixed annual pricing and contract length, how trials work and how long they last, and what self-hosted and single-tenant mean. If the team is comfortable, add a "most teams start from" range.

Engineers who can't size the cost hesitate to book a sales call, and clear terms filter out poor-fit leads before the call.

• A published range anchors negotiations

  Publish price drivers only, without numbers, at first.

• Your websitePricing page: "One price, unlimited usage." with no published prices or tiers; price depends on "environment size, complexity, and deployment goals"; "We can set up a trial at no cost."; self-hosting: "Reach out for details"; a table compares Subimage with open-source Cartography (only Subimage has managed operation, issue prioritization, vulnerability management, attack paths, an investigation agent, RBAC and SSO, and historical data); the only button is "Request pricing", which opens Cal.com; no FAQ.Source
• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source
• Competitor researchRivals' own homepages: JupiterOne, "See the risks hiding between your security silos", one graph with 200+ integrations, plain-English or J1QL queries, demo-led; Wiz, "Protect Everything You Build and Run", a security graph across code, cloud and runtime with red, blue and green agents, claiming more than 65% of the Fortune 100 as customers; Orca, "AI Security for Companies that Build", an agentless SideScanning CNAPP. None of the three shows prices on its homepage.See the research Source

Add four sections to /trust: what the read-only roles can and cannot access (linking the role definitions), subprocessors and hosting region, deployment choices (managed, single-tenant, self-hosted), and a short form to request the SOC 2 report under NDA. Offer a pre-filled security questionnaire as a download.

It shortens the security review that every deal goes through, and shows a security buyer that the vendor practises what it sells.

• Publishing too much detail

  Describe scope and policy, never internal configuration.

• Your websiteTrust center: lists SOC 2 Type II, with the report available by email request; links to the privacy policy, terms and DPA; no subprocessor list, data-collection scope or deployment options on the page.Source
• Your websiteHomepage: H1 "Subimage: The Open-Core Security Graph" and tagline "See what's exposed. Trace what it can reach.", "from the team behind Cartography"; customer names Veriff, Corelight, LangChain, Neo4j, Bree, Kontigo and Osmosis but no customer quotes; hourly read-only scans, on-prem or cloud; findings routed to Linear, Jira, Slack, webhooks or MCP; both main buttons ("Book a demo" and "Get started") open the same Cal.com booking page; the only social link is GitHub.Source
• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source

Name the icon buttons, raise contrast on the low-contrast text, add titles to the graph SVGs, and lazy-load the interactive demo and graph renderer below the fold. Re-run PageSpeed and keep the lab score above 85 with a check in CI.

It is a small cost for a design-led brand, and it protects the field scores as the homepage demo grows.

• Deferring the demo hides the best visual

  Show a static frame until it loads.

• Google PageSpeedHomepage mobile lab test (November 2026): performance 66/100, Total Blocking Time 1,360 ms, Speed Index 6.8 s, 932 KB with 461 KB of JavaScript (119 KB unused), accessibility 91 with three issues (buttons without accessible names, low colour contrast, SVG images without text). Real Chrome visitors pass Core Web Vitals: LCP 1.37 s, INP 93 ms and CLS 0.01 at the 75th percentile.Source
• HiringProduct Designer (YC jobs, San Francisco, $120K-$180K): security tools that "look and feel good to use are rare"; "We sell a graph; our product makes impossibly complex signals comprehensible"; the designer will own the visual identity and work with a design engineer.Source

Add LinkedIn and X links to the footer. Set a simple rhythm: one founder post a week, drawn from real work (an attack path pattern, a CVE check, a customer result), each linking to a page on the site. Repost case studies and new modules as they ship.

In security, people buy from practitioners they recognise, and founder posts cost nothing but time.

• The cadence slips during busy weeks

  Keep a backlog of five drafts.

• Your websiteHomepage: H1 "Subimage: The Open-Core Security Graph" and tagline "See what's exposed. Trace what it can reach.", "from the team behind Cartography"; customer names Veriff, Corelight, LangChain, Neo4j, Bree, Kontigo and Osmosis but no customer quotes; hourly read-only scans, on-prem or cloud; findings routed to Linear, Jira, Slack, webhooks or MCP; both main buttons ("Book a demo" and "Get started") open the same Cal.com booking page; the only social link is GitHub.Source
• Your websiteBlog index: ten entries since June 2025, including a case study each for Veriff and Corelight, an April 9, 2026 post arguing that each incident response should leave fewer attack paths, and three posts on other sites (a Venture in Security guest post on June 18, 2026, a Cartography post on inventorying AI agents in cloud environments on March 12, 2026, and a Medium post); the newest is dated July 22, 2026; there is no newsletter sign-up or RSS feed.Source
• Y CombinatorYC profile: SubImage, Winter 2025 batch, founded 2024, team size 4, San Francisco; a managed offering built on Cartography; the CEO created Cartography as a Staff Engineer at Lyft and previously worked on Microsoft's Red Team; the President was a Staff Engineer at Lyft who architected SIEM, insider-abuse and vulnerability-management platforms.Source

Generate one page per module from a template: what Subimage ingests, the attack paths it adds (for example Okta phishing to AWS through Identity Center), three example Cypher questions, built-in checks, and setup with the matching skill. Start with the ten modules that appear most in deals, and use one integration count everywhere.

Integration pages match high-intent searches, and they show depth where a rival only shows a logo.

• Thin, repetitive pages

  Every page needs a real attack path and real queries.

• Your websiteModules page: 57 modules in eight groups (cloud, data platforms, SaaS, security and vulnerability tools including Wiz, Orca Security, CrowdStrike and SentinelOne, identity including Okta and Microsoft Entra, networking, and corporate device tools), none with its own page; the CSPM page says "56 integrations".Source
• Your websiteSitemap (22 URLs, checked November 9, 2026): homepage, modules, five product pages (explorer, vulnerability management, attack path analysis, CSPM, CIEM), pricing, support, mission, four trust pages, the blog and seven posts; the newest post is dated July 22, 2026. No customers index, no comparison pages, no per-integration pages and no page for Cartography users.Source
• Competitor researchRivals' own homepages: JupiterOne, "See the risks hiding between your security silos", one graph with 200+ integrations, plain-English or J1QL queries, demo-led; Wiz, "Protect Everything You Build and Run", a security graph across code, cloud and runtime with red, blue and green agents, claiming more than 65% of the Fortune 100 as customers; Orca, "AI Security for Companies that Build", an agentless SideScanning CNAPP. None of the three shows prices on its homepage.See the research Source

Write one page each for Wiz and Orca customers: what their findings look like once Subimage adds identity paths (Okta, Entra), code ownership (CODEOWNERS, commits) and fix PRs. Use one worked example path, describe a 30-minute setup that reuses their existing findings, and explain when replacing makes sense later.

It makes the decision smaller (add, don't rip and replace) and targets teams who have already proven they buy cloud security.

• Vendors change their import formats

  Date each page and recheck every quarter.

• #9 Give each of the 57 modules its own page, starting with Okta, GitHub, Kubernetes and Wiz

• Your websiteAttack Path Analysis page: models "over 100 attacker capabilities" across AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra, Spacelift and Tailscale; rebuilt after every hourly sync; opens the fix pull request; imports Wiz and Orca findings with owning teams attached and "can also replace them"; quote from Veriff's Deputy CISO: "What I loved is that you're showing the connections".Source
• Your websiteModules page: 57 modules in eight groups (cloud, data platforms, SaaS, security and vulnerability tools including Wiz, Orca Security, CrowdStrike and SentinelOne, identity including Okta and Microsoft Entra, networking, and corporate device tools), none with its own page; the CSPM page says "56 integrations".Source
• Competitor researchRivals' own homepages: JupiterOne, "See the risks hiding between your security silos", one graph with 200+ integrations, plain-English or J1QL queries, demo-led; Wiz, "Protect Everything You Build and Run", a security graph across code, cloud and runtime with red, blue and green agents, claiming more than 65% of the Fortune 100 as customers; Orca, "AI Security for Companies that Build", an agentless SideScanning CNAPP. None of the three shows prices on its homepage.See the research Source

Publish two pages. Subimage vs JupiterOne covers the query language (Cypher against J1QL), the open schema and the ability to leave, deployment options, attack paths and pricing approach. Managed vs build-your-own covers the cost of syncs, database operations and correlation, using the Corelight figures. Date both pages and cite each rival's own site.

Buyers at the comparison stage are close to a decision, and fair pages earn trust with technical readers.

• Claims go out of date

  Show a last-checked date and sources.

• Your websiteSitemap (22 URLs, checked November 9, 2026): homepage, modules, five product pages (explorer, vulnerability management, attack path analysis, CSPM, CIEM), pricing, support, mission, four trust pages, the blog and seven posts; the newest post is dated July 22, 2026. No customers index, no comparison pages, no per-integration pages and no page for Cartography users.Source
• Competitor researchRivals' own homepages: JupiterOne, "See the risks hiding between your security silos", one graph with 200+ integrations, plain-English or J1QL queries, demo-led; Wiz, "Protect Everything You Build and Run", a security graph across code, cloud and runtime with red, blue and green agents, claiming more than 65% of the Fortune 100 as customers; Orca, "AI Security for Companies that Build", an agentless SideScanning CNAPP. None of the three shows prices on its homepage.See the research Source
• Your websiteCorelight case study (July 22, 2026): alerts needed 30 to 60 minutes of manual context; Corelight's self-managed security graph took "a full day of engineering each week"; triage fell to minutes; Corelight's triage agent chose Subimage for 20% of about 2,000 autonomous tool calls, twice the next tool, out of about 30 tools ("My agent is deciding to use your tool the most, by far"); the page ends without a call to action.Source

Make it a standing routine. When a critical, widely exploited CVE lands, publish within 24 hours a page with the free Cartography Cypher query to find affected images and packages, how Subimage ranks them by reachability, and a call to action to run the check on your own environment during a trial. Send it to the community and to newsletters that cover the CVE.

Every security team is searching on CVE day, and a free working query earns trust and links that a product page can't.

• Rushed posts contain errors

  Have a second engineer review each query before posting.

• Your websiteVeriff case study (January 20, 2026): tens of thousands of containers and 600+ repositories; a proof of concept with traditional tools showed "seven million vulnerabilities"; with Subimage, React2Shell exposure across 600-700 packages was cleared in minutes instead of days; the graph made attack paths easier to explain to non-technical executives; the page ends without a call to action.Source
• Your websiteBlog index: ten entries since June 2025, including a case study each for Veriff and Corelight, an April 9, 2026 post arguing that each incident response should leave fewer attack paths, and three posts on other sites (a Venture in Security guest post on June 18, 2026, a Cartography post on inventorying AI agents in cloud environments on March 12, 2026, and a Medium post); the newest is dated July 22, 2026; there is no newsletter sign-up or RSS feed.Source
• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source

Add an email sign-up and RSS to the blog. Send one email a month: one real attack path pattern (anonymised), one Cartography or Subimage query to find it, and product updates such as new modules or Issues features. Gather the off-site posts on the blog with canonical links.

Security buying cycles are long. A monthly, useful email keeps Subimage in mind until the budget opens.

• Slipping cadence

  Write two issues ahead.

• Your websiteBlog index: ten entries since June 2025, including a case study each for Veriff and Corelight, an April 9, 2026 post arguing that each incident response should leave fewer attack paths, and three posts on other sites (a Venture in Security guest post on June 18, 2026, a Cartography post on inventorying AI agents in cloud environments on March 12, 2026, and a Medium post); the newest is dated July 22, 2026; there is no newsletter sign-up or RSS feed.Source
• Your websiteIssues post (July 13, 2026): Subimage Issues groups CVEs by root cause (one example collapses 150 tickets into one), ranks by reachability, exploitation probability, fix availability and blast radius, closes issues when fixes are verified and reopens them if the problem returns; it ends with a booking link and a YouTube walkthrough.Source

When a setup skill finishes, it prints one line: the roles are ready, and a trial can start against them (with the trial booking link). Add a "Try it on your cloud" button to skills.subimage.io, list the skills in public agent-skill directories, and track installs from the repository to trial.

It reaches engineers inside the tools they already use, at the moment they have done the setup.

• Messages feel like ads inside a tool

  Make it one line, shown once, after success.

• #4 Put "Start a free trial" next to "Book a demo", because the trial already exists

• Your websiteSkills site: two free plugin sets for coding agents: subimage-setup (connect-aws, connect-gcp, connect-azure, connect-kubernetes-outpost, connect-github, connect-declarative-schema; "no SubImage tenant connection is needed" to generate the setup code) and subimage-mcp (14 investigation skills such as triage-new-findings and investigate-cve); no sign-up or trial prompt.Source
• Your GitHubSubimage GitHub organization: four public repositories, all pushed in the last 90 days: subimage-outpost (exposes internal APIs using Tailscale), helm-charts, skills, and collectors ("Customer-run metadata collectors for Cartography"); 3 stars in total.Source
• Your websitePricing page: "One price, unlimited usage." with no published prices or tiers; price depends on "environment size, complexity, and deployment goals"; "We can set up a trial at no cost."; self-hosting: "Reach out for details"; a table compares Subimage with open-source Cartography (only Subimage has managed operation, issue prioritization, vulnerability management, attack paths, an investigation agent, RBAC and SSO, and historical data); the only button is "Request pricing", which opens Cal.com; no FAQ.Source

As a project maintainer, invite production users to add themselves (a one-line pull request or a form) and run a short "how we use Cartography" series for those willing. This is project work and stays vendor-neutral. On Subimage's side, a larger list strengthens the "built on Cartography" claim and surfaces teams who may want the managed version (idea 1).

A visible adopter list is social proof for the open-source project and the company together, and adding a name costs adopters almost nothing.

• Large companies won't be named

  Allow descriptions by industry and size.

• Cartography projectCartography repository: 4.2k stars, 605 forks, Apache-2.0 licence. The README's "Who uses Cartography?" list names eight organizations (Lyft, Thought Machine, MessageBird, Cloudanix, Corelight, SubImage, Superhuman, Hadrian) plus "{Your company here}"; beyond that list it does not mention a managed version.Source
• Your websiteFunding post (October 20, 2025): "We've raised $4.2M"; Cartography was built at Lyft in 2019 and "more than 70 companies have adopted it in production"; the team spent seven months "heads-down building with our early customers".Source
• Cartography projectCNCF project page: Cartography "was accepted to CNCF on August 23, 2024 at the Sandbox maturity level"; 226 total contributing organizations.Source

Propose a joint case study (how Neo4j secures its own cloud with a Neo4j-based security graph), a guest post or talk at a Neo4j community event on attack paths as a graph problem, and a listing in Neo4j's partner or solutions pages if one exists. Offer Neo4j's community a free Cartography workshop.

It borrows a much larger developer audience that already thinks in graphs, with a story that is credible because it is true on both sides.

• Partner timelines are slow

  Start with the case study, which needs only approval.

• Your websiteHomepage: H1 "Subimage: The Open-Core Security Graph" and tagline "See what's exposed. Trace what it can reach.", "from the team behind Cartography"; customer names Veriff, Corelight, LangChain, Neo4j, Bree, Kontigo and Osmosis but no customer quotes; hourly read-only scans, on-prem or cloud; findings routed to Linear, Jira, Slack, webhooks or MCP; both main buttons ("Book a demo" and "Get started") open the same Cal.com booking page; the only social link is GitHub.Source
• HiringFounding Engineer (YC jobs, San Francisco, $170K-$230K): open problems include whether vulnerabilities are reachable ("Are the vulns on internet-facing assets?"), verifying agent-proposed fixes, a near-real-time map, resource ownership, tracking compliance processes and adding "time travel" to replay attacks; stack: Cartography, Neo4j, Python/FastAPI, Svelte with WebGL, an MCP server; "a seed stage company (a mighty team of 3!)"; Cartography is used by "over 70 companies" including "7 in the Fortune 100".Source
• Cartography projectCartography documentation (docs.cartography.dev): basic use, production operations, intel modules, development guides and a community meeting, with a CNCF Slack link; SubImage appears only as an intel module, and no managed option is mentioned.Source

When the first sync finishes, send the trial owner an automatic email or Slack message: the five highest-ranked Issues, each with its attack path, owner guess and fix, plus a count of findings deprioritised by reachability. Link to the explorer view of each path. Track how long it takes from connection to this message.

The first useful result decides a trial, and a security engineer's first "we have this problem" moment sells internally.

• Early data is incomplete

  Say which modules have synced so far.

• #4 Put "Start a free trial" next to "Book a demo", because the trial already exists

• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source
• Your websiteIssues post (July 13, 2026): Subimage Issues groups CVEs by root cause (one example collapses 150 tickets into one), ranks by reachability, exploitation probability, fix availability and blast radius, closes issues when fixes are verified and reopens them if the problem returns; it ends with a booking link and a YouTube walkthrough.Source
• HiringFounding Engineer (YC jobs, San Francisco, $170K-$230K): open problems include whether vulnerabilities are reachable ("Are the vulns on internet-facing assets?"), verifying agent-proposed fixes, a near-real-time map, resource ownership, tracking compliance processes and adding "time travel" to replay attacks; stack: Cartography, Neo4j, Python/FastAPI, Svelte with WebGL, an MCP server; "a seed stage company (a mighty team of 3!)"; Cartography is used by "over 70 companies" including "7 in the Fortune 100".Source

Add a monthly one-page export: attack paths closed and opened, Issues resolved and the time taken, findings deprioritised by reachability, the top three remaining paths in plain language, and the compliance score trend. Make it shareable as a PDF or link, with a footer saying it was produced by Subimage.

It gives the champion a renewal argument, and every board pack that carries it puts the product in front of executives.

• Numbers look bad in month one

  Show the trend from the first sync, not absolutes.

• Your websiteVeriff case study (January 20, 2026): tens of thousands of containers and 600+ repositories; a proof of concept with traditional tools showed "seven million vulnerabilities"; with Subimage, React2Shell exposure across 600-700 packages was cleared in minutes instead of days; the graph made attack paths easier to explain to non-technical executives; the page ends without a call to action.Source
• HiringProduct Designer (YC jobs, San Francisco, $120K-$180K): security tools that "look and feel good to use are rare"; "We sell a graph; our product makes impossibly complex signals comprehensible"; the designer will own the visual identity and work with a design engineer.Source
• Your websiteIssues post (July 13, 2026): Subimage Issues groups CVEs by root cause (one example collapses 150 tickets into one), ranks by reachability, exploitation probability, fix availability and blast radius, closes issues when fixes are verified and reopens them if the problem returns; it ends with a booking link and a YouTube walkthrough.Source

Offer a fixed-scope, two-week assessment: connect one cloud account read-only, and get a short report showing total findings, how many sit on internet-reachable paths to sensitive data, and the root-cause Issues that would clear most of them. Name the offer by its outcome, publish a sample report, and make it the main call to action on the vulnerability management page.

A number that drops from thousands to dozens is easy to share internally, and the buyer's own number makes the case far better than a demo.

• Assessments take too much founder time

  Automate the report from the first-sync data (idea 17).

• Your websiteVeriff case study (January 20, 2026): tens of thousands of containers and 600+ repositories; a proof of concept with traditional tools showed "seven million vulnerabilities"; with Subimage, React2Shell exposure across 600-700 packages was cleared in minutes instead of days; the graph made attack paths easier to explain to non-technical executives; the page ends without a call to action.Source
• HiringFounding Engineer (YC jobs, San Francisco, $170K-$230K): open problems include whether vulnerabilities are reachable ("Are the vulns on internet-facing assets?"), verifying agent-proposed fixes, a near-real-time map, resource ownership, tracking compliance processes and adding "time travel" to replay attacks; stack: Cartography, Neo4j, Python/FastAPI, Svelte with WebGL, an MCP server; "a seed stage company (a mighty team of 3!)"; Cartography is used by "over 70 companies" including "7 in the Fortune 100".Source
• Your websiteIssues post (July 13, 2026): Subimage Issues groups CVEs by root cause (one example collapses 150 tickets into one), ranks by reachability, exploitation probability, fix availability and blast radius, closes issues when fixes are verified and reopens them if the problem returns; it ends with a booking link and a YouTube walkthrough.Source

Publish a product page on agent exposure: which agents run in your cloud, which credentials and tools they hold, and the attack paths from an agent to secrets and data, all checked hourly with the same graph. Republish the March post on subimage.io, and add an example path and a Cypher query to the page.

Buyers are searching for this problem now, and Subimage can show reach (what an agent can touch), which an inventory alone doesn't.

• Crowded topic

  Lead with reach and attack paths, not discovery alone.

• Your websiteBlog index: ten entries since June 2025, including a case study each for Veriff and Corelight, an April 9, 2026 post arguing that each incident response should leave fewer attack paths, and three posts on other sites (a Venture in Security guest post on June 18, 2026, a Cartography post on inventorying AI agents in cloud environments on March 12, 2026, and a Medium post); the newest is dated July 22, 2026; there is no newsletter sign-up or RSS feed.Source
• Your websiteSitemap (22 URLs, checked November 9, 2026): homepage, modules, five product pages (explorer, vulnerability management, attack path analysis, CSPM, CIEM), pricing, support, mission, four trust pages, the blog and seven posts; the newest post is dated July 22, 2026. No customers index, no comparison pages, no per-integration pages and no page for Cartography users.Source
• Competitor researchRivals' own homepages: JupiterOne, "See the risks hiding between your security silos", one graph with 200+ integrations, plain-English or J1QL queries, demo-led; Wiz, "Protect Everything You Build and Run", a security graph across code, cloud and runtime with red, blue and green agents, claiming more than 65% of the Fortune 100 as customers; Orca, "AI Security for Companies that Build", an agentless SideScanning CNAPP. None of the three shows prices on its homepage.See the research Source

Package a startup plan: a fixed published price for companies under a set cloud size, covering CSPM with SOC 2 and ISO 27001 mapping, the compliance score, attack paths and Issues, with self-serve setup through the skills. Sell it through the YC network and startup communities, with an upgrade path as the company grows.

It catches companies early, when they choose tools that tend to stay, and a published price fits how startups buy.

• Low prices pull support time from enterprise deals

  Self-serve only, with community support.

• #5 Answer the five pricing questions security buyers ask before they book a call
• #14 Make the setup skills an entry point: they work without an account, so end each one with a trial offer

• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source
• Your websiteHomepage: H1 "Subimage: The Open-Core Security Graph" and tagline "See what's exposed. Trace what it can reach.", "from the team behind Cartography"; customer names Veriff, Corelight, LangChain, Neo4j, Bree, Kontigo and Osmosis but no customer quotes; hourly read-only scans, on-prem or cloud; findings routed to Linear, Jira, Slack, webhooks or MCP; both main buttons ("Book a demo" and "Get started") open the same Cal.com booking page; the only social link is GitHub.Source
• Y CombinatorYC profile: SubImage, Winter 2025 batch, founded 2024, team size 4, San Francisco; a managed offering built on Cartography; the CEO created Cartography as a Staff Engineer at Lyft and previously worked on Microsoft's Red Team; the President was a Staff Engineer at Lyft who architected SIEM, insider-abuse and vulnerability-management platforms.Source

Name and package an enterprise edition: self-hosted or single-tenant, helm-based install, customer-run collectors, SSO and RBAC, history, Issues and attack paths, with an annual licence and support terms. Write a deployment architecture page, and run outreach to the large Cartography users through community relationships, offering a supported upgrade from their existing graph.

The largest contracts sit with companies that won't send data out, and Subimage's open-core roots make self-hosting credible in a way it isn't for closed rivals.

• Self-hosted support strains a small team

  Limit it to a few design partners at first, with clear support terms.

• Long enterprise sales cycles

  Run in parallel with startup and mid-market deals.

• #1 Give Cartography's 70+ production users a page that shows when to stop running it themselves, with Corelight's numbers
• #6 Turn the trust center into a procurement pack: data scope, subprocessors, deployment and a SOC 2 request form

• HiringFounding Engineer (YC jobs, San Francisco, $170K-$230K): open problems include whether vulnerabilities are reachable ("Are the vulns on internet-facing assets?"), verifying agent-proposed fixes, a near-real-time map, resource ownership, tracking compliance processes and adding "time travel" to replay attacks; stack: Cartography, Neo4j, Python/FastAPI, Svelte with WebGL, an MCP server; "a seed stage company (a mighty team of 3!)"; Cartography is used by "over 70 companies" including "7 in the Fortune 100".Source
• Your websitePricing page: "One price, unlimited usage." with no published prices or tiers; price depends on "environment size, complexity, and deployment goals"; "We can set up a trial at no cost."; self-hosting: "Reach out for details"; a table compares Subimage with open-source Cartography (only Subimage has managed operation, issue prioritization, vulnerability management, attack paths, an investigation agent, RBAC and SSO, and historical data); the only button is "Request pricing", which opens Cal.com; no FAQ.Source
• Your websiteCSPM page: checks mapped to CIS AWS, GCP, Kubernetes and Google Workspace, SOC 2, ISO 27001 and NIST AI RMF with a daily compliance score; custom rules in Cypher; built-in checks are open-source Cypher in Cartography; "fixed annual pricing with single-tenant or self-hosted options"; secondary call to action: connect cloud accounts read-only to get a first-sync priority list.Source
• Your GitHubSubimage GitHub organization: four public repositories, all pushed in the last 90 days: subimage-outpost (exposes internal APIs using Tailscale), helm-charts, skills, and collectors ("Customer-run metadata collectors for Cartography"); 3 stars in total.Source

With customer consent and strict anonymisation, publish a yearly report: median attack paths per environment, the most common chains (for example CI/CD over OIDC to production IAM), the share of critical CVEs that are reachable, and time to close. Add free Cartography queries so readers can measure their own environment. Launch it with a talk and press outreach.

Original data earns coverage and links, and positions Subimage as the authority on attack paths rather than one more CNAPP.

• Too few customers for meaningful statistics

  Combine with opt-in community data and state the sample size.

• Customer data sensitivity

  Publish aggregates only, after customer review.

• Your websiteAttack Path Analysis page: models "over 100 attacker capabilities" across AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra, Spacelift and Tailscale; rebuilt after every hourly sync; opens the fix pull request; imports Wiz and Orca findings with owning teams attached and "can also replace them"; quote from Veriff's Deputy CISO: "What I loved is that you're showing the connections".Source
• Your websiteVeriff case study (January 20, 2026): tens of thousands of containers and 600+ repositories; a proof of concept with traditional tools showed "seven million vulnerabilities"; with Subimage, React2Shell exposure across 600-700 packages was cleared in minutes instead of days; the graph made attack paths easier to explain to non-technical executives; the page ends without a call to action.Source
• Your websiteCorelight case study (July 22, 2026): alerts needed 30 to 60 minutes of manual context; Corelight's self-managed security graph took "a full day of engineering each week"; triage fell to minutes; Corelight's triage agent chose Subimage for 20% of about 2,000 autonomous tool calls, twice the next tool, out of about 30 tools ("My agent is deciding to use your tool the most, by far"); the page ends without a call to action.Source

Offer incident-response and security consulting firms a partner programme. During or after an engagement, they connect Subimage read-only, show the client the remaining paths from the compromised asset (blast radius), and hand over a fix list. Firms get a referral fee or a reseller margin. When time travel ships, add an attack-replay view to their reports.

A breach creates budget and urgency at once, and the IR firm is the trusted adviser in the room.

• Firms see a competing service

  Position Subimage as their tool, under their report.

• Your websiteBlog index: ten entries since June 2025, including a case study each for Veriff and Corelight, an April 9, 2026 post arguing that each incident response should leave fewer attack paths, and three posts on other sites (a Venture in Security guest post on June 18, 2026, a Cartography post on inventorying AI agents in cloud environments on March 12, 2026, and a Medium post); the newest is dated July 22, 2026; there is no newsletter sign-up or RSS feed.Source
• HiringFounding Engineer (YC jobs, San Francisco, $170K-$230K): open problems include whether vulnerabilities are reachable ("Are the vulns on internet-facing assets?"), verifying agent-proposed fixes, a near-real-time map, resource ownership, tracking compliance processes and adding "time travel" to replay attacks; stack: Cartography, Neo4j, Python/FastAPI, Svelte with WebGL, an MCP server; "a seed stage company (a mighty team of 3!)"; Cartography is used by "over 70 companies" including "7 in the Fortune 100".Source
• Your websiteAttack Path Analysis page: models "over 100 attacker capabilities" across AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra, Spacelift and Tailscale; rebuilt after every hourly sync; opens the fix pull request; imports Wiz and Orca findings with owning teams attached and "can also replace them"; quote from Veriff's Deputy CISO: "What I loved is that you're showing the connections".Source