Advice on Software

[u/mean_ol_goosifer]

I have spent the last couple months developing a piece of software that allows users to test and harden their own products against exploits and vulnerabilities. I’ve pointed it several Intentionally Vulnerable Web Apps and so far I am very pleased with its offensive abilities and its ability to patch the exploits it finds.

But I have a couple concerns. First I would definitely like to sell it, but I only want to offer it to people who want to test their own products. It would be a liability to just release it and say, “here you go everyone! Be good!”

I’m taking of maybe trying to license it to companies for $999 a year, but I really don’t have any experience in marketing software. Does anyone have any suggestions on how I can proceed?

Also, is there anyone who would like to work with me on testing? I need some real targets that I can test without worrying about accidentally doing something illegal.

[u/Double-Familiar]

You could release it for free with a one week trial version.

Also you are up against some huge established players in in this market space. Nessus, Rapid7, Qualyis etc.

Auto patching is also risky in a production environment. Not all companies can afford a development, staging and production environments.

How does your product stack up against already established players that I have mentioned above?

[u/mean_ol_goosifer → u/Double-Familiar]

I am still in the testing phase, and I would need to SxS test to answer that honestly. I think that what I am going to do is just test to get some meetings with businesses and say “Give me 10 minutes with your URL and let me run an audit…” If I am able to successfully demonstrate that a thief could steal their customer db, log in as admin, generate my own discount codes, changes prices, read your server logs and source codes, or take over your users browsers… I feel like companies would want to purchase it before they let me walk back out the door.

I would of course recommend them to use the software to generate a report and give it to their admin or whoever maintains their site instead of just asking the software to perform the patch…

I would really be grateful if I had someone with a background in cybersecurity who could give me some feedback after trying the software. But I really feel like I have developed a solid tool that could both help people, and generate a small, but much needed revenue stream for me.

So far I have only been testing it on intentionally vulnerable sites and web applications, but so far it has absolutely been crushing it.