Observa

Rob Picard had spent over eight years in security, working as a penetration tester at Matasano Security and later handling application security and incident response at Addepar and Robinhood. Reading *The Launchpad* reignited his long-held dream of starting a software company. In late 2020, he applied to Y Combinator with an idea to build a lightweight intrusion detection system for early-stage companies—a simplified version of the complex systems he'd helped build at Robinhood.

Rob's first iteration aimed to capture the "80/20 rule" by detecting critical security issues more simply and cheaply than enterprise solutions. But reality quickly intervened. Key log sources were difficult to access, some required enterprise subscriptions, and worst of all, when he talked to potential customers, they didn't care. "This is a classic example of a solution in search of a problem," Rob admits.

So he pivoted. His second idea was more ambitious: coordinate real-time IP sharing between major consumer companies being attacked by credential-stuffing botnets. "Everyone thought this was cool," but after months of pitching, he couldn't get a single major company to run a pilot. Many didn't even have the detection or blocking capabilities he needed.

Third time's the charm, he thought. Rob built a tool to detect accidental public database exposure in AWS accounts—a high-signal, low-noise security issue. He launched it on Product Hunt, and "a handful of people signed up."

Observa's only traction came through direct outreach. Rob got a strong response when he offered to join YC startup Slack workspaces and provide free security advice. But that revealed a painful truth: "Most of the questions ended up being about issues blocking sales (compliance, questionnaires) as opposed to security issues."

Very little worked. Rob tried paid ads with no traction. He attempted product-led growth but didn't understand the effort required. Startups who signed up for free trials and integrated with their AWS accounts didn't care about the findings—the tool wasn't solving a burning problem. Rob never generated any revenue.

He later reflected: "Each of the products felt like they were solving a major problem. The reality was that they were describing a real problem, but didn't provide the right solution."

After 10 months (November 2020 to September 2021), Rob shut down Observa. He'd raised $462,000 but returned $370,545.77 to investors, taking responsibility for the failure. Rather than continuing to search for the right idea, he decided to join a company that had already figured out product-market fit. He cold-emailed Christina Cacioppo at Vanta, a security compliance automation platform, and joined as Security Lead.

Rob's reflection on his failure is refreshingly honest: "I wanted to be a successful entrepreneur, but I didn't want to spend years searching for the right idea." His key learning? Get people to actually pay for something before raising venture capital. Real revenue, not theoretical ideas, is all that matters.