Hey there,
I am going to blame the equinox. It fell on the twenty-third of September this year, in the middle of the most intense month we have had, and everything seemed to arrive around it at once. External audits, contracts, a matchmaking trip, a quarter's worth of decisions. I did not sit down to write here once. A year ago I opened the equinox entry by apologising for exactly the same thing, the night before that year's ISO 27001 audit, so at least I am consistent.
The equinox not only shifted things at work but also at home, where we are now getting ready to welcome our first baby into the world. At work, now that we are on the other side of it, three things have clearly shifted, and they all run into the same deadline. Before long I will be away for a while, and whatever these shifts ask of us has to be set up well enough to carry on without me in the room.
Three Weeks in a Straitjacket
For three weeks, from the middle of September to the end of it, external auditors went through the management systems we have built for Qwello, our launching customer. First ISO 27001, then ISO 9001 and ISO 14001. It was the first time our way of working had been put in front of a real audit. Not a demo, where I choose what to show, but an audit, where every claim needs a record behind it and every record has to lead to the next one. It is the closest thing to a straitjacket a prototype will ever be put in, which is exactly why I wanted it there.
It held. No major findings, and on the first day the information security auditor told us how far he thought the system had come in a year. He also told us he had been lenient, which is a kind thing to hear and comes with a date attached. The full recertification is next August.
The most useful thing he gave us was one polite sentence. Keep the simple risk register as the basis for treating risks, before moving anything into the quantitative one. I had spent most of the year on the quantitative one, putting a price in euros on each risk, and when we went looking we found our treatment plan had been built from the priced risks alone. Sixteen were standing in for eighty-one. I asked the agents to argue with me before we built anything new, and the first plan they brought back for the fix was itself over-built. We cut it by three quarters before we started. The risk agent now begins with the plain version and only reaches for money when a decision actually needs a number.
The quality and environment audits that followed gave us something different, a lot to think about on internal audits, which a company usually pays an outside firm to run. An agent could prepare most of that work. I am writing that down and leaving it there for now.
The Chicken and the Egg
By the end of this year we want a product a company can actually buy. The agents running on one shared graph of the whole management system, so an organisation can sign up, bring its people in and get going without us in the room.
Until now most of what we have built has been paid for by research and innovation funding, and that money buys research, not a product. Without a product there is not much revenue, and without revenue every next round of funding gets harder to argue for. Most startups meet some version of that loop. Ours has a very specific way out of it.
We are applying for an innovation loan from the same Estonian agency that awarded our grant with TalTech. The loan asks for the product to be at least at technology readiness level five, which roughly means it has been shown to work in a realistic setting and not only on our own bench. Qwello is that setting, and the audit was the first hard test of it. So the next three months have one job, which is to get us to level five and be able to show it.
Stories for When I Am Not There
Before the equinox the team spent a lot of its time on how. How the graph should be shaped, how the agents should talk to each other, how we want to work together. We needed those conversations, and for a while they were also where we got stuck. Somewhere around the equinox that turned. We know how now. What is left is to build it, in pieces small enough to show.
We have a new mantra for it. A startup should only be doing two things, shipping or selling. The week now has a rhythm to match. At the start of it each of us makes one promise of what will be shipped or sold, every daily check-in comes back to that promise, and at the end of the week we look at what became of it.
So most of my days right now go into writing user stories. Each one is a small, plain thing someone needs to be able to do, written well enough that the team can pick it up and build it without having to ask me. The first one on the table was the plainest of all: how does someone from outside get in? Every story gets the test the audit gave me. Is this what a team of three to five people needs, or the cleverer version I would enjoy building more?
It is an odd kind of writing. Everything I would normally say in a meeting has to be in the story already, because from November, for a while, there will not be a meeting with me in it.
A Year of Promises
The third shift came from the funding side, and it pulled my attention a whole year forward.
We finished the paperwork and contracts with TalTech, and the project starts with a kickoff this Thursday. Getting it there, I started to see the agency funding it the way I would see a client. It is paying us for a set of things we promised in the proposal, and it will want to see them delivered through 2027. The loan application, which I began drafting in the same weeks, adds its own promises on top. Laid side by side, they already describe a good part of next year.
The Horizon consortium is the longest thread, and it has grown one partner per event, roughly one event a season. Turku University of Applied Sciences came out of Connect4Cyber in Tallinn in January. RISE joined after the Stockholm edition in April. In September we went to a matchmaking event in the Netherlands and came back with the beginnings of a third, a small company whose technology fits closely with ours around supply chain security. Next year we build a first technical prototype together, with RISE and Turku helping us find end users to test it with, so that by November we submit the proposal from the strongest position we can.
That is a lot of promises to keep straight, to a lot of different people. So yes, a few weeks after an audit told me to keep things simple, I built more agents. Small ones this time. They hold how each funding instrument relates to the others and what we have promised to whom, and when a new cycle starts they tell us what it has to be about. The reporting gets easier, but mostly they keep us honest about what we said we would do.
Promises Made Without Me
For the next few weeks my own promise at the start of each week is the same one, more stories. Soon the team will be making theirs without me in the check-in.
By the time I am back, the team will have been building from stories I wrote without knowing exactly how each one would land. I have tried to make every one of them plain enough to need no explaining. Whether that was enough, I will find out when I open the first thing they shipped without me.
With care, Ben