Investor Pitch: Fill in the Blanks

Before the market numbers and the cost tables, most authentication founders need one paragraph that survives a first meeting. Investors in this category have heard the generic version — "we make login more secure" — a hundred times. What they actually want to hear is which authenticator factor you've chosen, which buyer segment you're gating first, and what regulatory or breach event is forcing that buyer to act now. Use the fill-in-the-blank frame below as a starting point, then swap in your own numbers once your plan's financial model is built.

Every bracket in that paragraph should map directly to a line item in your financial model, not a guess. If you can't yet fill in the SOC 2 timeline or the design-partner count, that's a sign the business plan — not the pitch deck — is the document to work on first. Avvale's bespoke business plan service builds this pitch paragraph alongside the full five-year forecast so the two documents never contradict each other in a due-diligence call.

The Multifactor Authentication Market: Size, Growth & Demand

The global multifactor authentication market was valued at $21.71 billion in 2025 and is forecast to grow to $25.04 billion in 2026 before reaching $78.53 billion by 2034, a 15.36% compound annual growth rate, according to Fortune Business Insights, 2025. Precedence Research puts the 2034 figure slightly higher, at $83.72 billion, which is a useful sanity check — the exact number moves between research houses, but every major forecaster agrees the market roughly quadruples over the next eight to nine years. Source: Precedence Research, 2025.

That growth is not abstract. It is being pulled forward by two forces a business plan should name explicitly. First, regulators keep raising the floor: NIST SP 800-63B now requires a phishing-resistant authentication option at Authenticator Assurance Level 2 (AAL2), the default tier for most workforce and customer access, and reserves the strictest hardware-bound controls for AAL3. Second, passkeys have gone from niche to mainstream faster than most vendors planned for — the FIDO Alliance reported roughly five billion passkeys in active use worldwide as of May 2026, with login success rates of 93% against 63% for passwords, per FIDO Alliance, 2026. A plan that still frames passkeys as "emerging" in mid-2026 will read as out of date to a technical investor.

Demand is uneven by sector, and a credible plan segments it rather than quoting one blended figure. Financial services leads adoption because FCA and equivalent regulators have driven MFA into the compliance baseline for years, and passkey adoption in fintech runs close to 60% versus roughly 28% in B2B SaaS and 18% in media and entertainment. That gap is an opportunity: a founder targeting a lagging vertical with a compliance-first pitch (healthcare, legal services, professional services firms handling client funds) is selling into genuine whitespace rather than competing head-on with Okta and Ping Identity for the fintech accounts they already own.

The incumbent landscape is worth naming directly rather than gesturing at "competition." Okta has raised roughly $228M across its funding history before going public; Ping Identity was taken private by Thoma Bravo after years as a public company; Yubico listed at an $800M valuation after raising $30M in its first major institutional round, per BankInfoSecurity, 2021; and Cisco paid $2.35 billion in cash for Duo Security in 2018, per SecurityWeek, 2018. Those numbers tell a founder two things: the exit market for a credible authentication vendor is real, and the workforce-IAM lane these companies occupy is expensive to attack head-on. The more fundable plans in 2026 pick a narrower wedge — a vertical, a factor type, or a deployment model the incumbents underserve — and use that wedge as the market-sizing story, not the $21.71B headline alone.

For UK founders building a plan against the same global figures, translate them into a domestic frame rather than quoting the headline number unadjusted. Using the UK's typical 4-5% share of global identity and access management spend as a modelling proxy, a domestic multifactor authentication market lands in the mid-hundreds-of-millions-of-pounds range for 2025 — this is an Avvale planning estimate, not a published third-party figure, and should be labelled as such in any plan submitted to a lender. What is directly sourced is the regulatory pull: the FCA has pushed MFA into the compliance baseline for UK-regulated financial firms for years, which is why fintech adoption of newer authentication methods consistently outpaces UK B2B SaaS and media in every industry benchmark cited above.

What It Costs to Build an Authentication Business

Building an MFA or passwordless identity product typically requires $38,000 to $265,000 (£30,000–£210,000) before the first enterprise contract closes. That range is wide because it spans two very different starting points: a lean two-founder team shipping a passkey wrapper on top of an existing identity provider versus a funded team building a standalone AAL3-capable platform with its own key management infrastructure. Unlike a retail or hospitality business, the largest cost driver here is not premises — it's the compliance and integration work that unlocks the first enterprise buyer.

Where a founder lands in that range should be a deliberate choice stated in the plan, not a byproduct of how much cash happens to be in the bank. The lean end of the range assumes the founding team writes most of the SSO connector code themselves and uses a compliance-automation platform (Vanta, Drata or similar) to cut audit-prep time; the upper end assumes contracted engineering help, a dedicated compliance hire from day one, and a broader connector library built before the first sales conversation rather than after it. Lenders reading a plan want to see which assumption you're making and why — a plan that simply states the top-line range without explaining which cost structure applies to your team reads as unfinished.

Cost Breakdown

• SOC 2 Type II readiness and audit: $18K–$60K (£14K–£47K) — the single gate that gets you past enterprise security review
• Sales & demand generation (analyst briefings, compliance-badge marketing): $4K–$53K (£3K–£40K)
• SSO/IdP connector engineering (Okta, Entra ID, Google Workspace): $5K–$45K (£4K–£35K)
• Cloud infrastructure, HSM key storage and uptime/SLA tooling: $6K–$40K (£5K–£31K)
• FIDO2/WebAuthn certification and a third-party penetration test: $9K–$35K (£7K–£27K)
• Legal (MSA/DPA templates, IP filings, incorporation): $3K–$20K (£2K–£16K)
• Cyber liability and technology E&O insurance: $3K–$12K/yr (£2K–£9K/yr)

Four line items make up most of the spend: SOC 2 readiness (roughly a third of the total), sales and demand generation (around a quarter), SSO connector engineering (about a fifth), and cloud/HSM infrastructure (roughly a fifth). Every one of those four is a recurring cost that scales with your customer count, not a one-time setup fee — a plan that treats them as sunk costs rather than ongoing cost-of-revenue will understate the real burn rate.

Funding Routes

In the US, cybersecurity founders can draw on standard SBA 7(a) loans (up to $5M) for hiring and infrastructure, and the SBA has run a dedicated Cybersecurity for Small Businesses pilot programme — it announced $3 million in new grant funding in 2024 to strengthen cybersecurity infrastructure for emerging small businesses, distributed through state agencies for training, counselling and tailored services, per SBA, 2024. Because this is a venture-shaped business, most founders combine a smaller SBA or bank facility for working capital with pre-seed equity or a SAFE, rather than trying to debt-finance the whole build. In the UK, Start Up Loans (up to £25,000 at 6% fixed) rarely cover a full SOC 2 and engineering budget on their own, but they can bridge the gap between a first design-partner cheque and a formal pre-seed close. Our bespoke business plan package builds the SBA- and lender-ready five-year model founders need for either route.

Team & Hiring: What It Costs to Scale Past the Pilot

The cost table above covers the pre-revenue build. The next spending wave, once a handful of design partners have signed, is headcount — and it is where many founders under-forecast their Year 2 burn. A realistic first hiring plan for an authentication vendor looks like: one senior security/compliance engineer to own the SOC 2 renewal cycle and incident-response runbook ($120K-$165K in the US, £70K-£95K in the UK); one customer success or solutions engineer to handle SSO/IdP integration support during onboarding ($90K-$130K US, £55K-£75K UK); and two account executives once the first design partners convert, typically compensated on a base-plus-commission structure totalling $140K-$190K US OTE each, or £80K-£110K UK. Plans that show 40 signed logos by the end of Year 2 without a matching increase in customer success and compliance headcount will not survive investor diligence — renewal and expansion revenue depends on both.

Revenue Model & Unit Economics

Authentication vendors sell almost entirely on a per-user, per-month basis, layered with enterprise contract minimums. Pricing across the category runs from about $2 to $10 per user per month depending on authenticator strength — SMS one-time-passcode tiers sit at the bottom, hardware-key and FIDO2 phishing-resistant tiers at the top. The number every founder in this space prices against is Microsoft Entra ID P1, bundled into many Microsoft 365 subscriptions at $6 per user per month. If your standalone price sits meaningfully above that without a clearly differentiated phishing-resistant tier, procurement teams will ask why they shouldn't just turn on what they already own.

Gross margins run 68–82%, typical for SaaS once cloud hosting and SMS/push delivery costs are netted out. Net margins are considerably thinner in the early years — 12–31% — because sales cycles are long and compliance overhead (the SOC 2 renewal, the annual penetration test, the security-questionnaire response team) doesn't shrink as revenue grows; it scales with logo count.

Worked example: a vendor closes a 3,000-seat mid-market financial-services contract at $3.50 per user per month. That single logo is worth $126,000 in annual recurring revenue. A four-person enterprise sales team, working a realistic 90-day SOC 2-gated sales cycle, can reasonably land 40 such contracts by the end of Year 2 — producing roughly $5.04M ARR before renewal expansion or upsell to higher-assurance tiers. That figure only holds if the SOC 2 attestation is already in hand when the sales team starts prospecting; founders who try to sell into mid-market finance or healthcare before the audit completes typically see deals stall in security review for months, which is the single most common reason an authentication startup's Year 1 revenue misses its plan.

Renewal and expansion economics deserve their own line in the forecast, not a rounding assumption. Authentication contracts expand two ways: seat growth as the customer's headcount grows, and tier upgrades as compliance requirements tighten — a customer that signs at the AAL2 tier often upgrades a subset of privileged accounts to AAL3 hardware-key coverage within 12-18 months once an internal audit flags it. A plan modelling net revenue retention below 105% is likely underselling the category; 110-120% is a realistic target once a vendor has a functioning customer success motion, because the upgrade path is built into the product itself rather than requiring a separate cross-sell.

Customer acquisition cost and payback period are the two numbers a lender or investor will stress-test hardest, and they behave differently here than in a typical horizontal SaaS category. Because the sales cycle is gated by a security review rather than a demo-to-close motion, CAC for a mid-market enterprise logo commonly runs $18,000-$35,000 once sales salary, security-questionnaire response time, and any analyst-briefing spend are fully loaded. Against a $126,000 ARR contract, that produces a payback period of roughly 2-3 months of gross margin — competitive with mainstream B2B SaaS, but only if the SOC 2 attestation is already complete when the sales cycle starts. Every month the audit slips is a month added directly to CAC payback, because the sales team is still drawing salary against a deal that legally cannot close.

Three Business Models Inside Authentication

"Multifactor authentication business" covers at least three genuinely different companies, and a business plan should say up front which one it's describing — lenders and investors read very different risk profiles into each.

Most first-time founders default to the vertical-specific SaaS model because it maps most cleanly onto a five-year financial forecast and a lender's expectations. The MSSP-delivered route is the fastest to initial revenue but caps valuation multiples because the vendor never owns the customer relationship. The developer-first API route is the model VCs recognise fastest — it's the Auth0/Stytch/Descope playbook — but it needs meaningfully more pre-revenue capital to build SDK coverage across enough languages and frameworks before self-serve signups convert into paying accounts.

Which model belongs in your plan depends on who's going to read it. A bank or SBA-adjacent lender wants the vertical SaaS model's clean, contract-by-contract revenue build — it maps to a debt-service calculation the same way a services business does. A venture investor evaluating a pre-seed round wants to see which of the three models has the fastest path to a repeatable, motion-tested sales process, because that's what a Series A round will actually be priced against. Naming the model explicitly in your executive summary, rather than letting a reader infer it from scattered details in later sections, is one of the fastest ways to signal that the plan was written with its audience in mind.

Licensing, Compliance & Legal Requirements

Authentication is one of the few niches where "licensing" means technical conformance and audit attestation rather than a permit from a local authority. There is no equivalent of a food hygiene certificate or a state trade licence gating entry — instead, the gate is a stack of overlapping technical standards, sector-specific supervisory expectations, and payment-industry rules that a buyer's procurement and legal teams will check independently before a contract is signed. Below is what a founder actually has to clear, by jurisdiction, and none of it should be treated as a one-time checkbox: every item on this list is re-verified annually by serious enterprise buyers, and a lapsed attestation can freeze renewal conversations as effectively as it blocked the first sale.

United States

• NIST SP 800-63B Authenticator Assurance Levels (AAL2/AAL3): AAL2 requires two distinct authentication factors and a phishing-resistant option; AAL3 requires a hardware-bound, phishing-resistant authenticator with a non-exportable private key — see NIST SP 800-63B
• CISA MFA guidance for small and medium businesses: shapes what "secure by default" looks like for your product's out-of-the-box settings — CISA
• SOC 2 Type II attestation: the de facto license to sell into enterprise; expect 6–12 months from kickoff to a Type II report
• State business registration and sales-tax nexus registration across the states where you have paying customers
• Patent and IP filings if your key-management or biometric approach is genuinely novel

United Kingdom

• NCSC guidance on MFA for corporate online services: the reference standard UK enterprise buyers will benchmark you against — NCSC
• FCA multi-factor authentication expectations for regulated firms: financial-services buyers will ask how your product supports their own FCA obligations — FCA
• Strong Customer Authentication under the Payment Services Regulations 2017, which implements PSD2 Article 97 and has been in force since 14 September 2019 — background at Wikipedia, Strong customer authentication
• Companies House registration, ICO registration (data protection fee), and professional indemnity insurance
• Cyber Essentials certification — increasingly expected before UK public-sector or enterprise procurement will even open a security review

European Union

PSD2's Strong Customer Authentication mandate requires two independent factors for electronic payments above €50 across the European Economic Area, and eIDAS governs the qualified electronic identification schemes your platform needs to interoperate with if EU public-sector or regulated-financial customers are on your target list. Founders selling into both the UK and EU should map their factor combinations against both the UK's post-Brexit SCA rules and the EU's PSD2 text separately — they have diverged since 2021 and a single compliance narrative no longer covers both.

Beyond the US, UK and EU

Founders planning a global sales motion should budget compliance-mapping time for at least three more frameworks. In Canada, the Canadian Centre for Cyber Security's guidance and PIPEDA's data-handling obligations shape what enterprise buyers expect from an authentication vendor's own security posture. In Australia, the ASD's Essential Eight maturity model treats MFA as one of its eight mandatory mitigation strategies for government and increasingly for private-sector suppliers, which makes an Essential Eight mapping a genuine sales asset rather than paperwork. In the UAE, the Dubai Electronic Security Center and the wider NESA framework push regulated entities toward strong authentication controls, and free-zone technology companies selling into government-adjacent buyers should expect a security review that mirrors SOC 2 in substance even where the certificate itself isn't recognised.

Five Mistakes That Sink Authentication Startups

The mistakes below aren't generic startup advice — they're specific to what breaks in an authentication business, and several are drawn from real, publicly documented incidents. Every one of them shows up in a business plan as a missing line item, not just a product decision, which is why lenders and investors reading a rushed plan tend to spot them immediately.

• Shipping push-only MFA with no number matching. MFA fatigue (or "push bombing") attacks — flooding a user with approval prompts until one gets tapped by accident or frustration — enabled real breaches at Uber and Cisco, and MFA fatigue combined with help-desk social engineering led to the 2023 MGM Resorts ransomware incident, which shut down hotel systems, slot machines and booking platforms and cost the company more than $100 million, per Rippling's analysis of MFA fatigue attacks. A product without number matching or rate limiting by default is selling the same gap that caused those breaches.
• Pricing above the $6/user/month Entra ID P1 anchor without a differentiated tier. Buyers who already pay for Microsoft 365 E3/E5 have MFA "for free" in their existing bundle; a standalone vendor has to win on a phishing-resistant tier, a compliance mapping, or a vertical workflow Entra ID doesn't cover — not on being "more secure" in the abstract.
• Treating SOC 2 Type II as a post-launch nice-to-have. It is the gate, not a feature. Founders who start the audit clock only after their first enterprise prospect asks for it lose 6-12 months of sales momentum they'd already priced into their forecast.
• Underbuilding the SSO/IdP connector library. A product that only integrates with one identity provider caps deal size to SMBs who don't need enterprise-grade authentication in the first place — exactly the segment with the lowest willingness to pay.
• No incident-response or key-rotation runbook. Every serious enterprise buyer now sends a security questionnaire before signing, and "how do you rotate compromised keys" is a standard question. Founders who can't answer it in writing lose the deal in procurement, not in the product demo.
• Writing one compliance narrative for every country on the go-to-market list. UK SCA rules, EU PSD2, and US frameworks like HIPAA and PCI DSS have diverged enough since 2021 that a single "we're compliant" slide reads as unresearched to a buyer's legal team — the licensing section of your plan should map each target jurisdiction separately, the way the section above does.

Sample Business Plan Preview

Here's an extract from a sample multifactor authentication business plan built on our template — so you can see exactly what a buyer receives:

What's in the Template

Every Avvale business plan template includes these sections, pre-structured for your industry:

• Executive Summary — Your business at a glance, written to hook investors in 60 seconds
• Company Overview — Legal structure, ownership, location, and founding story
• Industry Analysis — Market size, growth trends, and regulatory landscape
• Customer Analysis — Target verticals, buying committee, and security-questionnaire readiness
• Competitor Analysis — Incumbent mapping (Okta, Duo, Ping Identity, Yubico) and your differentiation wedge
• Marketing Plan — Channels, messaging, and customer acquisition strategy
• Operations Plan — SOC 2 timeline, connector roadmap, and key delivery milestones
• Management Team — Founder bios, advisory board, and key hires planned

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with income statement, cash flow, balance sheet, break-even analysis, and startup capital requirements — sequenced against your SOC 2 milestone so the numbers and the compliance story line up. Founders comparing adjacent identity niches may also want our identity access management (IAM) business plan template, which covers the broader workforce-identity category this business sits inside.

Frequently Asked Questions