I walked away from what many would call a dream job; running the U.S. Army's AI lab, building autonomous ground vehicles and next-generation command and control systems. Not because the work wasn't fulfilling. Not because the mission wasn't important. But because I realized that the biggest threat to American technological superiority wasn't happening on a battlefield. It was happening in conference rooms, buried under mountains of compliance documentation.
The Innovation Paradox
Over the course of my career in the Army, I built dozens of software products. Some were small internal tools. Others were sophisticated AI systems that pushed the boundaries of what we thought was possible. Each project followed a familiar pattern: exciting technical challenges, brilliant engineers, rapid prototyping, and then... the wall.
That wall was compliance. Not security itself, we all understand why security matters. The wall was the process of demonstrating compliance. The endless documentation. The manual control mappings. The months-long assessment cycles. The back-and-forth with assessors over documentation formatting.
I watched project after project lose momentum. Not because the technology failed. Not because the team wasn't capable. But because the compliance burden was so enormous that by the time we navigated through it, the technology was outdated, the budget was exhausted, or the mission need had evolved.
The Real Innovation Killer
Here's what most people outside government don't understand: compliance isn't a hurdle to innovation. It's the hurdle. By far. More than any technical challenge. More than any budget constraint. More than any bureaucratic process.
Building an autonomous ground vehicle that can navigate complex terrain? That's hard, but it's solvable engineering. Building a command and control system that processes real-time battlefield data? Challenging, but doable with the right team.
Getting either of those systems through DoW RMF authorization? That's a multi-year, multi-million dollar journey that requires specialized consultants, mountains of documentation, and often derails the entire project.
The Numbers Are Sobering
I've seen projects where the compliance cost exceeded the development cost. Where the authorization timeline was longer than the technology lifecycle. Where innovative small companies gave up on government contracts because they simply couldn't afford the compliance overhead.
And it's not just DoW. FedRAMP authorizations take 12-18 months on average. CMMC requirements are eliminating entire categories of small defense contractors. Every framework adds more controls, more requirements, more documentation.
Why Government Can't Fix This
After years inside the system, I came to an uncomfortable realization: this problem cannot be solved from within government. Not because people don't care. Not because they don't recognize the issue. But because of how the system is fundamentally designed.
Government systems are built to add rules, not remove them. Every breach leads to new requirements. Every audit finding leads to additional controls. Every incident leads to more documentation. This is the security ratchet, it only turns one direction.
The Bureaucratic Incentive Structure
Consider the incentives at play:
- If you're a compliance officer who relaxes requirements and something goes wrong, you're responsible.
- If you're a compliance officer who adds requirements and something goes wrong, you followed best practices.
- If you're an agency creating policy, proposing to reduce requirements is politically risky.
- If you're an agency creating policy, adding requirements shows you're "taking security seriously."
The result is predictable: requirements accumulate. Documentation expands. Timelines stretch. Costs balloon.
Government will never build a tool to streamline this. Why? Because building and scaling technology platforms is not what government does well. And even if they tried, the tool would be subject to the same compliance requirements it's trying to solve, buried under procurement processes and budget cycles.
The solution must come from a private entity that can move fast, iterate quickly, and scale without bureaucratic constraints.
The GRC Industry Is Failing Us
"But wait," you might say, "there are already GRC (Governance, Risk, and Compliance) tools out there." Yes. I've used them. I've evaluated them. I've watched teams struggle with them. And they're part of the problem.
Expensive Checklists with Lip Service Automation
The current GRC industry is large but fractured, and most tools fall into the same trap: they're glorified checklist managers with "automation" that amounts to little more than copy-paste templates.
These tools:
- Require deep expertise — You need to already understand NIST 800-53, FedRAMP overlays, and framework mappings just to use the tool effectively.
- Cost a fortune — Enterprise licenses run hundreds of thousands of dollars annually, putting them out of reach for most projects and small organizations.
- Demand consultants — The tools are so complex that you need to hire expensive consultants to configure them and train your team.
- Focus on documentation, not security — They help you create compliance documents, but they don't actually make your systems more secure or reduce the time to authorization.
Built for the 1%, Not the 99%
The current tools are optimized for huge defense primes and enterprise SaaS companies with dedicated compliance teams, million-dollar budgets, and multi-year timelines. They're built for the 1% of projects that have massive resources.
But what about the other 99%? What about:
- The Army software team building an internal logistics system
- The startup with an innovative AI solution for intelligence analysis
- The mid-size contractor trying to get their first DoW contract
- The government lab that needs to deploy a new research tool
- The small business that wants to offer a cloud service to federal agencies
These projects shouldn't need consultants. They shouldn't need a PhD in compliance frameworks. They shouldn't need six-figure tool licenses. But today, without those things, they're dead in the water.
The Vision: Democratizing Compliance
What the market needs is a tool that treats compliance like a solvable problem, not a revenue opportunity. A tool that uses AI not as a buzzword, but as a way to genuinely automate the tedious, repetitive work that dominates compliance processes.
Imagine a compliance platform that:
- Guides you like a GPS — You don't need to understand every control in NIST 800-53. The tool asks you questions about your system and tells you what you need to do.
- Generates documentation automatically — Using OSCAL and AI, it creates assessment-ready SSPs, SAPs, and SARs from your inputs.
- Works for novices — A developer who's never dealt with compliance can get started without hiring consultants or taking months of training.
- Costs what software should cost — Priced for real projects and real teams, not just Fortune 500 enterprises.
- Actually improves security — Not just documentation theater, but real guidance on implementing controls that matter.
This is what Pretorin is building. Not a better checklist. A fundamentally different approach that treats compliance as an automation problem, not a consulting engagement.
The National Security Imperative
This isn't just about making life easier for software teams. It's about American competitiveness and national security.
We're in a Technology Race
Rising great powers are investing heavily in AI, autonomous systems, cyber capabilities, and advanced software. They're not burdened by the same compliance overhead. They're moving fast.
Meanwhile, we're letting our most innovative technologies, all of which are software-dependent, languish in multi-year, multi-million dollar compliance journeys. Every month we spend on documentation is a month our adversaries spend on innovation.
Innovation as a Strategic Advantage
America's greatest strategic advantage has always been our innovation ecosystem. Our ability to turn cutting-edge technology into deployed capabilities faster than anyone else. Our entrepreneurial spirit. Our world-leading tech sector.
But we're squandering that advantage. We're making it so hard for innovative companies to work with government that many simply choose not to. We're making it so expensive to deploy new software that agencies stick with decades-old systems. We're making it so slow to get through authorization that by the time systems are approved, they're obsolete.
If we don't fix this, we will fall behind. Not because we lack the talent. Not because we lack the technology. But because we've made it impossible to actually deploy that technology at the speed and scale required.
Why I Left to Build Pretorin
Running the Army's AI lab was an incredible opportunity. I got to work with brilliant people on problems that mattered. Autonomous systems that could save lives. AI that could give commanders better situational awareness. Technology that was genuinely cutting-edge.
But every project hit the same wall. And I realized that building one more cool system that would get stuck in compliance purgatory wasn't going to change anything. The only way to truly have impact was to solve the compliance problem itself.
This is a problem that:
- Government can't solve from the inside
- Current GRC vendors won't solve because their business models depend on complexity
- Will only get worse if left unaddressed
- Has massive national security implications
- Can be solved with modern technology and the right approach
So I left to build Pretorin. Not because the Army's mission wasn't important, but because this mission is foundational to that mission and every other software-driven initiative in government.
The Path Forward
We can't eliminate compliance requirements, nor should we. Security matters. Risk management matters. But we can change how we approach these requirements.
We can move from manual documentation to automated generation. From months-long assessments to continuous validation. From compliance as a blocker to compliance as an accelerator. From tools that require experts to tools that create experts.
This is what drives me. This is why Pretorin needs to exist. Because every day we don't solve this problem is another day that:
- Innovative projects die under compliance burden
- Small companies are locked out of government contracts
- Agencies stick with outdated technology because upgrades are too painful
- Our adversaries gain ground in the technology race
We can do better. We must do better.
Join Us
If you've felt this pain, if you've watched brilliant technology get buried under compliance requirements, if you've seen innovation delayed by authorization processes, if you believe we need to do better, I want to hear from you.
Whether you're a developer who's struggled with FedRAMP, a government program manager who knows this problem firsthand, a contractor who's been priced out by compliance overhead, or just someone who believes American innovation is too important to be held back by outdated processes; get early access to Pretorin and help us build the solution this problem deserves.
This isn't just another SaaS product. This is about unleashing American innovation. This is about national security. This is about making sure that the best technology, not just the best-documented technology, gets deployed where it's needed most.
That's why Pretorin needs to exist. And that's why I'm betting everything on making it happen.
Isaac Faber
Founder, Pretorin
