# Mycroft Aiolum story: https://aiolum.com/story/mycroft/ · added 2026-11-11 · updated 2026-11-11 **In short.** Mycroft (AI security and compliance officer for software companies, Canada): Nearly CA$2M a year recurring revenue, February 2026. Evidence grade D: reported, not verified. Team: 3 co-founders in 2024; 10 people before the seed round of June 2025, 15 by September 2025, about 20 in February 2026. Launched 2024; still running. AI security and compliance officer for software companies · Canada · AI-native · started small, grew after funding · still running · group: Finance, risk and compliance - Outcome: Nearly CA$2M a year recurring revenue, February 2026 (evidence grade of the headline number: D; headline in US dollars: 1459747) - Launch: 2024; months from launch to the outcome: 18 - Team: 3 co-founders in 2024; 10 people before the seed round of June 2025, 15 by September 2025, about 20 in February 2026 - Outside funding: US$1.2M pre-seed (September 2024) and US$3.5M seed (June 2025) - Main factor: Domain expertise - Meters, 1 to 4: evidence strength 1, copyable pattern 2, capital needed 3 - Tags: AI-native, Small team, Funded, Running, B2B, Compliance Links: - Visit mycroft.io: https://www.mycroft.io/ **The product.** A software platform and an AI agent that prepare a software company for security audits such as SOC 2, ISO 27001, HIPAA and FedRAMP. It collects evidence, watches cloud accounts and laptops, and runs penetration tests. Human experts back it up on the higher plans. **Why it worked.** Three founders who had worked in security, compliance and product for years built a compliance platform for software companies. BetaKit reported in September 2025 that Mike Kim, the chief executive, had worked in security and compliance for more than a decade. His employers included KPMG, EY, FreshBooks and PartnerStack. Software companies need audit reports before large customers sign, and the founders sell a faster way to get them. Evidence grades: A = disclosed by a public company, a filing or a payment processor, or verified by one; B = two or more independent reports agree, or a journalist confirmed it; C = a founder claim that no one else verified; D = reported, not verified: one founder claim or a third-party estimate with no second source; E = no revenue figure found, so the headline is a non-money fact and the other facts carry their own grades; calc = computed on this page from graded facts. ## Summary Mycroft sells GRC software, short for governance, risk and compliance: tools that collect evidence that a company follows security rules. Customers use it to pass audits such as SOC 2, a security report that an outside auditor writes about a software company. Mycroft calls its agentic AI, software that takes several steps on its own, a "security and compliance officer". Higher plans add penetration testing and a dedicated security expert. Mike Kim, Jonathan Mendes and Jan Jedrasik founded the company in Toronto in 2024, BetaKit reported on 22 September 2025. The earliest copy of the company website in the Internet Archive is from 28 August 2024. BetaKit reported a US$1.2 million pre-seed round from September 2024 and a US$3.5 million seed round from June 2025. It reported 10 staff before the seed round and 15 after it. On 19 February 2026 BetaKit reported about 20 employees and more than 100 customers. The headline figure is a statement in a BetaKit article of 19 February 2026, labelled sponsored: annual recurring revenue "nearing $2 million CAD". The article does not name who gave the figure, and no payment-processor profile or filing confirms it. It is grade D. The company publishes no prices, so this page cannot check the figure against a price list. ## Why did Mycroft work? ### The chief executive had done security and compliance work for a decade BetaKit reported that Kim worked in security and compliance for more than a decade at KPMG, EY, FreshBooks and PartnerStack. Mendes co-founded PartnerStack and Jedrasik was Kim's first hire there. Kim told BetaKit that Mycroft is the product the team "wish we had" earlier. ### One platform replaces several separate tools, the company says The company says its platform combines audit evidence, cloud monitoring, device management, vendor risk checks and penetration testing. The pricing page lists them in the plans. This is the company's description. No customer or press source measured the saving. ### Human experts sit behind the AI on the higher plans The Scale and Managed plans add a customer success manager or a dedicated chief information security officer. The company's case studies say that its experts guided customers through the audit. The AI agent is therefore one part of a service that also uses people. ### Customers get an audit report faster, according to the company The company's case studies say that Weave finished SOC 2 Type 1 in under 30 days. They say Unified finished SOC 2 Type 2 in 6 weeks. These are company-published stories with customer quotations. They are not independent audits of the claim. ## How it was built These details come from the company's own pages. They are grade C and no outside party has checked them. - The AI features run on Google Gemini models served through Google Cloud, according to the company's AI disclosure. - The company says its AI features write, summarise and sort text, and that they do not decide whether a customer is compliant. - The company blog says the platform connects to more than 250 tools to gather evidence. - The company says its no-code AI agents act on events, for example locking a stolen laptop. - The AI disclosure says the company runs an AI management system under ISO/IEC 42001:2023. - A Risk Operations Center of security experts watches customer environments, according to the pricing page. Sources: [14, 3, 5] ## Who tried this before Mycroft, and why did they fail? Three records in our database of failed startups are the closest matches that a search found. Each is a security, networking or compliance-infrastructure company. None sold audit-readiness software, so the match is loose. The values below are from that database and are not independently verified. The failed startups come from our database of dead startups, retold here in our own words; Its entries are AI-assisted summaries of public sources, so they carry no evidence grade. ### Toopher (2011 to 2018; funding US$3.0M cash burned; cause: Market) - Promise: Two-factor login for enterprises that checks the user's physical location. - Why it died: The record says Salesforce bought it in 2015 and later discontinued the technology. It cites a failure to gain enough market. - Record: ### Ionx Networks (2019 to 2025; funding US$12.0M; cause: Competition) - Promise: Enterprise network infrastructure for companies moving to the cloud. - Why it died: The record says it died of "competitive asphyxiation" in a market that consolidated faster than it could build defences. - Record: ### Railsr (2016 to 2024; funding US$121.0M; cause: Operations) - Promise: Banking-as-a-service interfaces with compliance infrastructure for fintechs. - Why it died: The record calls it an operational failure in a regulated industry. - Record: ## What changed The three records sold security, networking or regulated banking infrastructure to other companies. The records describe markets with larger rivals or heavy rules. The records give competition, a failed market fit and operations as causes. Mycroft sells into the same kind of market. Three things differ in the sources. Mycroft sells to software companies that need audit reports to close sales, according to its case studies. BetaKit reports a team of about 20 and US$4.7 million of funding. The company also adds human experts to the software, which is how the company describes the higher plans. ## Can one person copy Mycroft now? **Verdict: Not as a solo project. The idea is open; the audit work is not.** A solo founder cannot copy the full product, because the sources describe a funded team of about 20 with security experts on staff. A narrower piece is open: one audit framework for one kind of customer. The founders' own route started from a decade of security and compliance jobs. 1. Pick one framework, such as SOC 2, and one customer type, such as software start-ups. 2. Use a public model API for drafting policies and sorting evidence, and keep a person responsible for each audit. 3. Name customers and publish their results with their permission, as the company does with its case studies. 4. Check whether a price page or a demo call fits the buyers, since the company publishes no prices. **What is still open.** A single framework for a single industry that the large platforms serve poorly, such as a country's own privacy law or a government supplier standard. ## How much revenue does Mycroft make? The numbers, graded Revenue is one unattributed press figure from February 2026. Customer counts, funding and team size come from two press articles and the company's own pages | Fact | Value | Grade | Note | Sources | |---|---|---|---|---| | Annual recurring revenue, February 2026 | nearing CA$2 million | D | BetaKit sponsored article, 19 February 2026: "annual recurring revenue nearing $2 million CAD". The article names no speaker for the figure. | [1] | | The same figure in US dollars | about US$1.46 million, an upper bound | calc | Calculated: CA$2,000,000 divided by 1.3701 Canadian dollars per US dollar, the Federal Reserve H.10 rate of 19 February 2026. The article says "nearing", so the true figure is lower. | [1, 15] | | Customers, February 2026 | more than 100 | D | BetaKit, 19 February 2026. No customer list is given for this count. | [1] | | Customers, September 2025 | more than 50 in six months | C | The company blog by Mike Kim and BetaKit both give it on 22 September 2025. BetaKit names Superwhisper, CoVet, Unified.to, Willful, Wisedocs and Weave. | [2, 3] | | Team, February 2026 | about 20 employees | D | BetaKit, 19 February 2026, as "roughly 20 employees". | [1] | | Team, September 2025 | 10 people, then 15 after the seed round | C | BetaKit, 22 September 2025: the seed money "expanded its 10-person team to 15", with five more planned. | [2] | | Founders | three: a chief executive, a head of product and design, a head of engineering | C | BetaKit, 22 September 2025, says Mike Kim founded the company in 2024 with Jonathan Mendes and Jan Jedrasik. The company's About page lists the same three as co-founders. | [2, 6] | | Pre-seed funding | US$1.2 million, September 2024 | C | BetaKit reported it as financing raised through a simple agreement for future equity, led by Ripple Ventures. | [2] | | Seed funding | US$3.5 million, June 2025 | C | BetaKit and the company blog, 22 September 2025: led by Luge Capital. BetaKit gives total funding as US$4.7 million. | [2, 3] | | Earliest company web page | 28 August 2024 | C | An Internet Archive copy of mycroft.io with the footer "Mycroft Technologies Inc." and the year 2024. No earlier company name was found. | [9] | | Months from the first archived page to the headline | 18 months | calc | Calculated: August 2024 to February 2026. The founding month is not published. | [9, 1] | | Prices | none published | C | The pricing page shows three plans and no amounts. The archived copy of 22 January 2025 also shows no amounts. | [5, 8] | | AI model provider | Google Gemini models on Google Cloud | C | The company's AI disclosure, revised 12 August 2026. | [14] | | Frameworks supported | SOC 2, ISO 27001, GDPR, HIPAA, CMMC, FedRAMP and others | C | The company's home page lists them. | [4] | How to read this table. Grade D is a figure reported once and not verified. Grade C is a statement by the company or by the press that two sources repeat. A "calc" value was computed on this page. ## Pricing Mycroft plans as the company's pricing page shows them on 11 November 2026: no price is published | Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit | |---|---|---|---| | Platform | | | no price published; GRC platform, cloud security, training, threat monitoring, trust center, basic AI workflows | | Scale | | | no price published; adds penetration testing, vendor risk management, a customer success manager | | Managed | | | no price published; adds a dedicated chief information security officer and custom frameworks | The page lists three plans and asks the visitor to book a demo or talk to sales. Platform has a Get started button. An archived copy of the same page from 22 January 2025 shows three plans, Foundation, Scale and Managed, also without prices. Foundation is now called Platform. The terms say customers pay fees set in a statement of work and are invoiced. ## When did Mycroft launch, and how did it grow? Timeline The company grew from a first archived web page in August 2024 to about 20 staff in February 2026. The press and the company report the rest. - **28 August 2024** (grade C [9]): The earliest Internet Archive copy of mycroft.io shows a security-compliance page signed Mycroft Technologies Inc. It says Mycroft helps customers move 5x faster than traditional compliance automation platforms. It already names AI agents that take multi-step actions. - **September 2024** (grade C [2]): BetaKit reported a pre-seed round of US$1.2 million, led by Ripple Ventures, raised through a simple agreement for future equity. - **22 January 2025** (grade C [8]): An archived pricing page lists three plans, Foundation, Scale and Managed, with no prices. - **Early 2025** (grade C [2, 3]): BetaKit says the product reached the market earlier in 2025. The company blog says it onboarded 50 customers in six months. - **June 2025** (grade C [2]): BetaKit reported the US$3.5 million seed round, led by Luge Capital. - **22 September 2025** (grade C [2, 3]): The company announces the seed round and 50 customers. BetaKit reports that the team grew from 10 to 15 with the seed money. - **December 2025** (grade C [1]): Mycroft completes the Cyber Challenge, a programme of Rogers Cybersecure Catalyst for Ontario security start-ups. - **19 February 2026** (grade D [1]): A sponsored BetaKit article reports more than 100 customers, about 20 employees and recurring revenue nearing CA$2 million. - **11 November 2026** (grade C [4, 5]): The home page now leads with FedRAMP and CMMC certification and offers three plans without prices. ## What could go wrong for Mycroft? - **What is not verified.** The recurring-revenue figure rests on one sponsored BetaKit article of 19 February 2026, which states it without naming a speaker. No payment-processor profile, filing or second article confirms it. A reader could look for a statement by the company or a later press interview. The customer count of more than 100 and the headcount of about 20 rest on the same article. - **The figure sits in a sponsored article.** BetaKit labels the 19 February 2026 piece "SPONSORED ARTICLE", presented by Rogers Cybersecure Catalyst, which ran the programme that Mycroft completed. The company is not named as the sponsor in the page text. - **No independent source confirms that customers pay.** BetaKit names six customers and says the company has more than 50 clients. The company's terms describe fees and invoices, and its plans are tiered, but no price is published. The company says its customers pay. No independent source confirms it (casebook 29). - **Trust signals on the company site.** The home page shows a logo section headed "Trusted by security-first leaders" with no names in the page text. The footer of every page shows badges for SOC 2, GDPR, HIPAA and PIPEDA, and a G2 "High Performer" badge. No auditor's report or G2 listing was read to confirm them. An archived home page of 19 May 2025 said the service was supported by "1,000+ analysts"; the current page does not. The testimonials and case studies are the company's own publications. They name executives of Weave, Unified and Wisedocs, which BetaKit also names as customers. - **Part of the offer is expert service.** The offer mixes software with expert work, and the sources do not say what share of revenue each brings. The home page promises "experts to run your audit" and "An audit that’s fully managed". The Managed plan includes a dedicated chief information security officer. The Platform plan is described as everything a customer needs to do the work itself. The terms describe a software-as-a-service platform and separate professional services. - **The AI disclosure is narrower than the marketing.** The company's AI disclosure describes less than its marketing does. The company blog says its AI agents make "intelligent decisions in real-time" and lock a stolen laptop. The disclosure of 12 August 2026 says the AI features generate, summarise, classify or reformat text. It says they "do not make decisions on the customer's behalf". BetaKit described the product in February 2026 as AI agents "guided by human oversight and specialized expertise". ## Sources 1. BetaKit, 19 February 2026: How Mycroft scaled to over 100 customers without a playbook (sponsored article) — https://betakit.com/how-mycroft-scaled-to-over-100-customers-without-a-playbook/ (grade D). Read in full on 11 November 2026 after reading betakit.com/robots.txt. Source for the revenue figure, customer count and headcount. Labelled sponsored. 2. BetaKit, 22 September 2025: Mycroft raises $3.5 million USD to deliver Goldilocks security for startups — https://betakit.com/mycroft-nabs-3-5-million-usd-to-help-other-tech-startups-simplify-security-and-compliance-with-agentic-ai/ (grade C). Read in full. Source for the founders, the two funding rounds, the named customers and the team of 10 growing to 15. 3. Mycroft blog, 22 September 2025, by Mike Kim: Stealth to seed — https://www.mycroft.io/blog/stealth-to-seed-mycrofts-ai-security-compliance-platform-backed-by-3-5m-led-by-luge-capital (grade C). Read in full. The company's own announcement of the seed round and 50 customers in six months. 4. Mycroft home page, read 11 November 2026 — https://www.mycroft.io/ (grade C). Read in full after reading mycroft.io/robots.txt, which allows all agents. Source for the product, the logo section, the footer badges, the testimonials and the frameworks. 5. Mycroft pricing page, read 11 November 2026 — https://www.mycroft.io/pricing (grade C). Read in full. Three plans, no amounts. 6. Mycroft About page, read 11 November 2026 — https://www.mycroft.io/about (grade C). Read in full. Lists the three co-founders and their backgrounds. 7. Mycroft Master Services Agreement (terms page), read 11 November 2026 — https://www.mycroft.io/terms (grade C). Read the sections on services and on fees and payment. Source for the legal name and for fees invoiced against a statement of work. 8. Internet Archive copy of the Mycroft pricing page, 22 January 2025 — https://web.archive.org/web/20250122124442/https://mycroft.io/pricing (grade C). Read in full. Shows the plans Foundation, Scale and Managed without prices. A copy of 15 September 2024 shows no plans. 9. Internet Archive copy of the Mycroft home page, 28 August 2024 — https://web.archive.org/web/20240828230956/https://mycroft.io/ (grade C). Read in full. The earliest company copy found. Copies of 2019 and 2022 show a registrar's placeholder and an empty page, so no earlier product was found. 10. Internet Archive copy of the Mycroft home page, 19 May 2025 — https://web.archive.org/web/20250519143814/https://www.mycroft.io/ (grade C). Read in full. Source for the earlier "1,000+ analysts" wording. 11. Mycroft case study: Weave, read 11 November 2026 — https://www.mycroft.io/case-studies/weave (grade C). Read in full. A company-published customer story with a quotation by Weave's chief executive. 12. Mycroft case study: Unified, read 11 November 2026 — https://www.mycroft.io/case-studies/unified (grade C). Read in full. A company-published customer story with a quotation by Unified's chief executive. 13. Mycroft case study: Wisedocs, read 11 November 2026 — https://www.mycroft.io/case-studies/wisedocs (grade C). Read in full. A company-published customer story with a quotation by Wisedocs' chief operating officer. 14. Mycroft AI Disclosure, revised 12 August 2026 — https://www.mycroft.io/ai-disclosure (grade C). Read in full. Source for the AI model provider and the AI governance statement. 15. US Federal Reserve, H.10 foreign exchange rates, Canada, read 11 November 2026 — https://www.federalreserve.gov/releases/h10/hist/dat00_ca.htm (grade A). Read the row for 19 February 2026: 1.3701 Canadian dollars per US dollar. The site has no robots.txt. 16. Database of failed startups, local export — /method/#dead (grade C). Record pages read on the website on 11 November 2026. AI-written summaries, not independently verified. Source for the failed predecessors. Contact: aiolum@livyden.com. Run Mycroft? Send corrections or a verified figure to aiolum@livyden.com (subject: Correction: Mycroft).