Preflight
Cyber diligence built for the shape of a venture deal.
Results in 20 minutes on any target — before your partner meeting is over. Covenants for the term sheet, mapped to what the scan actually found. And a portfolio-wide LP-letter section that gets easier every quarter, not harder.
The thesis
Most cyber diligence was built for a $50M PE check with weeks of budget and a dedicated firm. Preflight is built for a $5M Series A term sheet closing on Friday — associate-driven, dollar-quantified, and small enough to fit inside the partner meeting.
Three moments in the deal
Each moment eats hours you don’t have. Preflight ends each one with its own tool— one subscription, one workflow.
Pre-term-sheet, at close, and every quarter after — the three places cyber diligence actually shows up in a venture deal. Handled today by an associate + Google + hope. Solved here by three moments that share one substrate.
Partner meeting is Monday.
≈ half a day · associate · Google
Someone runs a quick BuiltWith check. Maybe HIBP the CEO’s email. The security question in the memo gets a hedged one-liner, because nobody wanted to say “we don’t know.”
01 The scan
A 20-minute red-flag scan on any target.
Dark-web credential exposure, DMARC posture, attack surface, breach history, peer percentile. Delivered inside your partner meeting window.
See itTerm sheet lands, closing in three weeks.
≈ 0 protections · findings in a PDF nobody signs
You found real red flags. Now what? Board seat gives you a voice, not recourse. Findings without covenants are findings. You’ll bring it up at the first board meeting. Maybe.
02 The covenants
Every red flag, a signed covenant.
Each finding maps to a proposed covenant clause your counsel drops straight into the term sheet or SPA — reviewed quarterly by a tier-1 M&A firm.
See itInstitutional LPs ask about portfolio cyber posture.
≈ 2 weeks of ops-time per quarter · hand-written
Chase every portco for a self-attestation. Copy-paste into a Notion doc. Realize half the fields are stale by the time you send. LP files it. Next quarter, start over.
03 The LP letter
A one-page cyber section, generated.
Every scan you’ve run + every covenant you’ve landed + posture movement across the portfolio — in a one-page section ready for the quarterly LP letter.
See itAct 01 · The scan
What lands in your inbox 18 minutes later.
Findings on one side. Term-sheet covenants that fix them on the other. Every scan delivers both.
Not full QCD-worthy at this stage. Land covenants at term sheet; revisit at Series C.
- 42 employee credentials in known breach dumps (last 24 months)72p
- DMARC policy =
none— email spoofing possible48p - No public SOC 2 or Trust Center55p
- No exposed cloud storageclean
- No prior public breach or disclosureclean
Within 60 days of Closing, the Company shall complete credential rotation for all employees whose credentials appear in known breach databases as of the Cyber Red-Flag Scan dated [scan date], and shall implement mandatory password-manager adoption within 90 days.
Within 90 days of Closing, the Company shall implement DMARC with a p=reject policy, complete SPF and DKIM alignment, and provide the Board with evidence of enforcement.
Act 02 · The covenants
A finding on its own is a slide in a deck. A finding in the term sheet is enforceable protection.
Every red flag maps to a proposed clause your counsel drops straight into the term sheet or SPA. Not homebrewed — reviewed quarterly by a tier-1 M&A firm, with soft / hard / closing-condition variants and location guidance built in.
Act 03 · The LP letter
Your next LP letter has a cyber section now.
Every scan you run flows into a portfolio view. Every quarter, a one-page cyber section is ready for the LP letter — specifically shaped for what institutional LPs are asking about right now.
(FAIR · probability-weighted)
(remediation-attributable)
this quarter
in signed term sheets
Who Preflight is for
Built for how venture actually works.
20-minute scans and covenant libraries sound tactical. What they buy you is strategic — fund reputation, deal leverage, exit valuation, LP confidence. If you’re a VC, the segment page walks through the “why now” and the “what changes” in your language.
Read the VC-side deep diveWhere we are
Design partners first. Pricing published at GA.
We’re running a design-partner cohort with a limited number of funds this fall. Public pricing lands with the GA release. If your fund would benefit from being on the cohort, get in touch.
Cyber diligence in the shape of your deal.
Results in 20 minutes, term-sheet covenants mapped to real findings, and portfolio-wide LP-letter reporting — on one subscription. Design-partner cohort open now.