Action’s fastest sellable wedge is a managed quarterly access-review service, not another agent platform
Asked (summary):
The service-desk product is weak and the space is crowded. What else can this team build, given long-horizon agents and strong LLMs?
Asked (follow-up, summary):
That answer is not good enough. Find a narrower product that many companies already budget for yearly — a wedge they can start selling immediately. Assess the team and tech and figure out what they can build.
This report draws on 4 of Action’s own pages (site, MSA, privacy policy), 383 research rows on recurring security and compliance budgets, 362 rows on access-review requirements and audit evidence, 447 rows on access-review competitors (95 with any public price), and one independent founder mention. The recommendation: sell “Access Review Operator” — an annual subscription that runs quarterly user-access reviews end to end for 100–1,000-employee, Google Workspace-centric companies under SOC 2 or ISO 27001. The public team picture is thin, so the team assessment below rests on demonstrated product capability, not a roster.
The product is one closed loop, run every quarter — and Action’s disclosures already describe most of it
The quarterly access-review loop. Green steps are capabilities Action already discloses on its own pages (access reviews, Workspace Admin SDK reads, admin-approved account and group changes, Slack/email delivery, credentialed write actions, browser agents, approvals). Blue steps are packaging work. Hover or tap a step for detail and the source.
Action’s privacy policy already states it runs access reviews and reads Workspace users, groups, OUs, licenses, authorized third-party apps and audit events, and — with admin approval — creates, suspends and deletes accounts:
action.soIts MSA already contracts for workflows performing “provisioning, deprovisioning, account changes, and other write actions” under customer-granted scopes and credentialed actions, deployed via SOWs:
action.soSOC 2 Type II auditors expect three to four review cycles ~90 days apart, with proof that revoked access was actually removed — the exact closed loop above:
novantra.ioAuditors now ask for before/after exports, reviewer identity, timestamps and remediation tickets — a manager-signed PDF alone no longer passes:
scrutineer.ai
The budget already exists, and the proposed price sits inside it
Annual budget bands from the research rows (directional secondary-market comparisons, not authoritative quotes). Blue bars are market bands; green bars are the proposed Access Review Operator SKUs — a pricing hypothesis anchored to these comparisons, not a known Action price. Hover a bar for the source.
Access-review platform plans alone run roughly $7,500–$30,000 a year (Pathlock’s published tiers), while enterprise IGA averages ~$240,000 with 6–12-month rollouts:
guideflow.com,
toriihq.comManaged SOC 2 recurs every year at $10,000–$60,000 for the managed layer alone — the access-review control sits inside that budget line:
cipherssecurity.com50–200-employee companies already budget $20,000–$45,000 a year just to maintain compliance after the first audit:
radius360.coOnly PCI DSS fixes an interval (six months); SOC 2 auditors in practice expect quarterly — so the work recurs four times a year, forever:
itsecureops.com
Team and technology fit: what the public record supports
Agent / workflow engineering, approvals, workflow state, ticket sync
Evidence status Demonstrated
Basis Site: drafts workflows from tickets; background agents complete work end-to-end; two-way ticket sync
Google Workspace reads and admin-approved writes
Evidence status Demonstrated
Basis Privacy policy: Admin SDK users/groups/OUs/licenses/apps/audit events; approved create/suspend/delete
Slack / email delivery and follow-up
Evidence status Demonstrated
Basis Deployed in Slack/Teams; email triage, drafting and sending
Credentialed browser execution for long-tail apps
Evidence status Demonstrated
Basis MSA Section 1.8 credentialed actions; browser-using background agents
Professional-services deployment motion
Evidence status Demonstrated
Basis MSA: SOWs and professional services to configure and deploy agents
Named team / individual track records
Evidence status Thin — do not overclaim
Basis Site claims alumni of OpenAI, xAI, Cognition, Applied Compute, Mercor, Ramp without names; one independent page names founder Jingkang Yang (NTU MMLab PhD)
ITGC / access-review domain sales, auditor relationships, broad connector catalog
Evidence status Missing
Basis No public evidence; next hire should be an experienced ITGC/access-review operator or seller, not another LLM researcher
Why this wedge and not the adjacent candidates
Access Review Operator (recommended)
Annual budget evidence Plans $7.5k–$30k/yr; sits inside recurring compliance spend
Why not (or why yes) Capability already disclosed; differentiator is closed-loop remediation for the long tail, which dashboards (Vanta/Drata) track but do not operate
Automated pentesting
Annual budget evidence $5k–$30k engagements, annual
Why not (or why yes) No demonstrated offensive-security capability or accepted-report credibility
Full managed SOC 2
Annual budget evidence $10k–$60k managed layer, annual
Why not (or why yes) Crowded with platforms, auditors, consultancies; far more domain operations required
Cyber-insurance renewal automation
Annual budget evidence Annual urgency via carriers and premiums
Why not (or why yes) Broker/carrier distribution and underwriting expertise missing
Security-questionnaire automation
Annual budget evidence Attached to every enterprise deal
Why not (or why yes) Easy to build, extremely crowded, weakly differentiated
SaaS spend / renewal management
Annual budget evidence Renewals consume budgets yearly
Why not (or why yes) Many incumbents; needs procurement data and negotiation operations
Access-review operations is not necessarily the largest eventual market; it is the best immediate product–team–distribution fit.
The exact initial SKU
Access Review Operator — annual managed outcome, not seats. “Quarterly access reviews for up to 10 systems and 250 employees, audit-ready evidence, verified remediation” at $12,000–$18,000 per year plus a small onboarding fee; a 25-system / 1,000-employee package at $24,000–$36,000. First campaign delivered in 14 days. Do not underprice as a $99 SaaS tool. Prices are hypotheses anchored to public market comparisons.
Minimum product (ten parts):
- System and account inventory
- Review-scope builder
- Reviewer routing from manager and app-owner data
- Slack/email attestation: retain / revoke / modify with rationale
- Persistent reminders and escalation
- Admin approval before any write action
- API or browser execution of approved changes
- Post-change re-query with screenshot/log proof
- Exception register
- Auditor package: before/after exports, reviewer identity, timestamps, decisions, approvals, remediation proof
Ideal customer: 100–1,000 employees, Google Workspace + Slack, ~10–30 important SaaS apps, SOC 2 Type II or ISO 27001, lean IT team, reviews currently in spreadsheets or Vanta/Drata tasks. Start with Workspace, GitHub, AWS, Slack, Salesforce, Snowflake, NetSuite/QuickBooks by demand. Avoid Fortune 500 IGA replacement. Buyer: Head of IT, security/compliance lead, or controller; triggers: audit in 30–90 days, prior access finding, first Type II period, rapid hiring or layoffs, or an auditor asking for proof revocations were enforced.
Competitors and public pricing: the mid-market managed gap
Of 447 competitor rows, only 95 carry any public price. The table shows representative vendors across the range; the pattern is seat-priced software or custom-quoted enterprise IGA — nobody sells the operated quarterly outcome at a fixed annual price. Position as complementary to Vanta/Drata: they track the control, Action operates and closes it.
| Vendor | Product | Target customer | Public pricing | Source |
|---|
| Pathlock | Access Certification module | Enterprises on SAP / business-critical apps | From $7,500 to $30,000 per year by tier | guideflow.com |
| Vanta | Access Reviews | Compliance-first teams on SOC 2 / ISO 27001 | Custom quote; tracks the control, customer still runs it | guideflow.com |
| Microsoft | Entra ID Governance | Microsoft-standardized enterprises | From $7 per user per month, annual | guideflow.com |
| Okta | Identity Governance | Okta-identity enterprises | Workforce plans from $6 per user per month; governance needs full bundle | guideflow.com |
| SailPoint | IdentityIQ | Fortune 500, regulated industries | ~$240,000 average annual, $75,000+ entry; 6–12 month rollouts | toriihq.com |
| Oracle | Identity Governance | Oracle-ecosystem enterprises | From $3,600 per user or $180,000 per processor | toriihq.com |
| Lumos | Autonomous identity platform (Albus AI) | SaaS/cloud-centric orgs | Custom quote | toriihq.com |
| ConductorOne | Unified Identity Graph | Cloud identity teams | Custom quote; approve/revoke only, smaller connector library | toriihq.com |
| Multiplier | Jira Service Management IGA | Jira-centric IT teams | $5 per user per month | guideflow.com |
| ManageEngine | ADManager Plus | AD / Microsoft 365 shops | Paid editions from $795 per year | guideflow.com |
| Nudge Security | SaaS security & governance | Small security teams | $750 per month billed annually up to 150 users | nudgesecurity.com |
| Zluri | SaaS management & access reviews | Mid-market IT | $300+ per month | flamingo.run |
| Torii | SaaS management platform | IT teams on Google Workspace | Enterprise pricing; may exceed smaller budgets | toriihq.com |
| Rippling | Identity & access add-on | Companies on Rippling HR/IT | Starts at $8 per user per month | heimdalsecurity.com |
30-day sales plan and validation gates
Next 30 days
- One landing page: fixed scope, “first campaign in 14 days”
- Founder-sell to 50 SOC 2 / ISO companies with 100–1,000 employees
- Partner with five boutique SOC 2 auditors, vCISOs, compliance consultants and Vanta/Drata implementation shops
- Paid $3k–$5k first-campaign pilot, credited toward an annual plan
- Ask prospects for their last access-review spreadsheet and auditor request list
- Close three design partners before expanding connectors
Validation gates
- Three paid campaigns within 45 days
- One standard onboarding path under five business days
- ≥80% of entitlements reviewed without staff hand-editing spreadsheets
- ≥90% of approved revocations executed and verified automatically or with one safe human approval
- Auditor accepts the evidence packet without material rework
- Delivery under one staff-day per quarterly campaign after onboarding
- Two of three pilots convert to annual agreements
- If customers refuse scoped write access: start read-only plus customer-approved execution — never retreat to a generic attestation dashboard
Method: built from five result sets — 4 Action pages (site, MSA, privacy policy) for capability evidence; 383 rows on recurring compliance/security budgets across 263 hosts; 362 rows on access-review requirements across 214 hosts; 447 competitor rows across 99 hosts (95 with a public price; 14 representative vendors shown); 1 independent founder-profile row. Budget bands are directional secondary-market comparisons in USD per year, not quotes; proposed SKU prices are hypotheses. Cut for space: most of the 447 competitor rows and per-framework cadence detail beyond SOC 2, ISO 27001 and PCI DSS.