u/Shama_lala

Spent months wiring up tracking across 6 client properties. Events firing, data flowing, spreadsheets everywhere. Asked myself last week, which channel actually drives retained users? Silence. Not because the data doesn't exist. Because I built a data landfill, not a data system.

Nobody actually cares about your beautiful dashboard, they care about the raise they're gonna get from using it. The founders crushing it right now aren't demoing features. They're promising a before and after. You currently spend 8 hours on this. You won't anymore. That's it.

PLG or GTFO, but make sure the G is an outcome, not a UI tour.

Spent six months convinced we had a product problem. Rebuilt features. Shipped faster. Churn stayed flat. Turned out users weren't leaving because of what we built... They were leaving because they never actually used it. Activation was the leak, not the product. Fixed the activation flow, churn dropped 28% in eight weeks... Data was screaming at us the whole time. We just weren't listening...

We spent four months testing onboarding tools and here's what nobody admits: most of them optimize for activation metrics while your actual revenue leaks stay invisible. Skeneai was the only one that pushed us to look at where users dropped based on real behavioral data, not just funnel aesthetics. Turns out our onboarding problem was actually a pricing page problem.

I've been deep in onboarding research for a client's B2B SaaS tool. Looked at Notion, Linear, Loom, a bunch of smaller PLG plays. The ones that actually work share something uncomfortable in common: they don't try to impress you.

No animated feature spotlights. No here's everything we can do checklist. The best one I saw this month was a project management tool that skipped the tour entirely, dropped you in a pre-filled workspace, and let you delete what you didn't need. That's it.

The reason most onboarding is bad has nothing to do with copy or design. It's that the flow was built to look good in a board meeting or a Product Hunt launch, not to help a confused person at 11pm trying to solve a real problem. Founders optimize for wow, that was slick during demos. Real users just want to not feel lost. Those are completely different goals and almost nobody admits it.

We ran a proper comparison. Six tools, same product, same user cohort, 90 days. The results nobody wants to publish: four of them produced statistically identical activation rates. The differentiation is almost entirely in pricing pages and sales decks, not actual outcomes. Vendors sell personalization but deliver fancy tooltips.

Time to second value is the most ignored number in SaaS. Not time to first value. The second one. Users who hit a meaningful outcome twice in week one retained at 3x the rate of users who hit it once. Nobody talks about this.

\*\*Some context on where I'm coming from\*\*

I work at a small bootstrapped tech startup. We've got a pipeline of larger enterprise clients ready to onboard, but they're asking for ISO 27001 certification before we can move forward. No certification, no deal. It's that simple.

My first instinct was to figure out the cheapest viable path to certification which meant actually trying to understand what ISO 27001 requires, what an ISMS needs to look like, how to document it, implement it, and prove it to an auditor.

That was a humbling few weeks.

I quickly understood why consultants and GRC platforms exist. It's not because the standard is impossible to read — it's because the gaps between \*reading\* it and \*applying\* it correctly are full of landmines that aren't obvious until you've already stepped on them.

A few that nearly caught me out:

\* \*\*Scoping\*\* — defining what's in and out of your ISMS sounds straightforward until you realise that a scope defined too narrowly (e.g. production infrastructure only, while your staging environment holds real customer data) is something an auditor will flag immediately

\* SOA - I need to justify every exclusion with enough rigour that an auditor is satisfied. "Not applicable to our business" is not a justification

\* \*\*Risk traceability\*\* — every risk needs to trace forward to the control treating it, and every control needs to trace back to the risk driving it. Break that chain anywhere and you've got a nonconformity

\* \*\*Creating a system\*\* — the PDCA cycle, management reviews, internal audits, continual improvement. The standard isn't asking for documentation, it's asking for a functioning management system

I looked at Vanta and Drata. Both are genuinely impressive platforms. Both also start at $7,500–$10,000 a year before you get anywhere near the features a first-time implementer actually needs. For a bootstrapped startup, that pricing is really a hurdle.

\*\*So I started building something\*\*

The core idea is that it isn't just a tool — it's a structured assistant that walks a founder or operator from zero ISO 27001 knowledge through to having practical, auditor-ready next steps in front of them.

The workflow I'm building around:

1. \*\*Profiling\*\* — understand the organisation's context, stack, team structure, and interested parties (the 4.1/4.2 groundwork that everything else builds on)

2. \*\*Risk assessment\*\* — guided, interactive, using the asset-threat-vulnerability model with consistent scoring so it's repeatable and audit-defensible

3. \*\*Framework mapping\*\* — which of the 93 Annex A controls apply, which don't, and why — with justifications strong enough to put in front of an auditor

4. \*\*Policy centralisation + documentation\*\* — generating the mandatory documented information the standard requires, pre-mapped to the relevant clauses

5. \*\*Execution\*\* — a prioritised action plan based on your actual risk profile, not generic advice

One feature I'm particularly excited about: a view that pulls up the relevant ISO 27001 clause or Annex A control and highlights exactly how your current policies and evidence map (or don't map) to the standard's requirements. No more guessing whether what you've written actually satisfies Clause 6.1.3. You can see the gap directly.

The goal is to cut through the noise — the generic blog posts, the consultant-speak, the overwhelming onboarding flows — and give founders a clear, honest picture of where they actually stand against the standard.

I hope that I can get some inputs to validate whether this is a real problem worth solving, or whether I've just had an unusually bad experience.

A few specific questions for those of you who've been through ISO 27001 implementation — especially at smaller companies:

1. \*\*What was the hardest part of your implementation?\*\* Was it the risk assessment, the SoA, getting leadership buy-in, the internal audit, something else entirely?

2. \*\*How did you handle it?\*\* DIY, consultant, GRC platform, some combination?

3. \*\*If you went the platform route\*\* — Vanta, Drata, Sprinto, Scrut, anything else — what did it get right and where did it fall short?

4. \*\*Is there a specific stage of the process\*\* where you wish you'd had better tooling or guidance?

5. \*\*Would a tool like this have been useful to you?\*\* What would have made it genuinely valuable vs. just another compliance SaaS?

I'm not trying to pitch anything here. I'm trying to figure out whether what I'm building actually solves the right problems. Brutal honesty is genuinely more useful to me than encouragement right now.

Thanks in advance. This community has already been incredibly useful just as a lurker, hoping to give something back eventually.