Escher GTM Plays

The trigger. An enterprise customer shows interest. You have a lean team, as many agents as people, and SOC2 lands in your inbox with no prep.

What most find when they go looking. Nothing at all, or a shitty SOC2 from the year before that raised more questions than it answered. Priya opens the AWS console for the first time with security in mind. The S3 bucket their product writes to: public. The IAM user they use for deployments: AdministratorAccess, key created on day one, never rotated, stored in a .env file that got committed to the repo twice. Root account: no MFA. CloudTrail: off. Three security groups with 0.0.0.0/0 ingress she doesn't remember creating.

The trap. Confusing evidence collection with evidence generation. Most automation is just structured collection: a tool pulls an API snapshot instead of a human taking a screenshot. Better hygiene, not a different thing. Vanta and Drata solved collection. That works for configuration-state controls: encryption enabled, MFA enforced, branch protection configured. Process controls are different. Access reviews, change approvals, incident response still depend on human-generated artifacts. Type I friction is mostly gone. Type II ceiling hasn't moved. Early-stage teams also need to know what matters and what can wait. That judgment is domain-specific. HIPAA is not ISO is not SOC2 Type I.

Where existing tools stop. Escher is the bridge between your team and the auditor. Claude Code helps Priya write the fix, draft the policy, answer the questionnaire. The writing gets faster but it starts from what Priya tells it. She still has to go find that out herself. Console, service by service, region by region, reconstructing what exists before she can describe it to anything. The three days become two. The hard part is exactly as hard. That's the gap Escher fills.

Growing startups hit the same inflection points — cost discovered a week late, over-provisioned access found during an audit, a sudden SOC2 request, a junior engineer asking what permissions to give Claude. These aren't four problems. They're the same problem across four surfaces: AWS Cloud Infra Management, FinOps with infra visibility, IAM for teams and agents, and Sec Ops.

An infra hire means the founding team has hit the ceiling. Not of knowledge but execution. They know dev environments are idle, they know the bill is off. Identifying the problem is easy. Going through 36 VMs, three regions, seven services to actually fix it is what stalls. The job post is the moment they admit they can't do it alone.

New services, new permissions every day. Every two or three days a new ad hoc request. The tech lead becomes the routing point for the whole team — easy for him, impossible for everyone else. Already using Claude and ChatGPT to manage the ops load, still spending a disproportionate amount of time on it.

A GTM hire (first AE, CSM, Solutions Engineer) means enterprise deals are landing. Now the infrastructure has to work like a real company's.