The "Smallest Slice" Framework: How to Validate Before You Build

The Framework

Here's something most founders get wrong. They experience a problem, assume others have it too, and start building. Sometimes that works. Usually it doesn't.

Adam Markowitz at Drata had a unique advantage. He'd personally lived the pain of SOC 2 compliance at his previous company, Portfolium. He'd built internal tools to solve it. He knew the problem was real.

And he still spent 6 months talking to dozens of companies before writing a line of code.

Why? Because at Portfolium, it took him 3 years to realize what the real product should be. He said it himself: "We were 3 years into this journey before we started actually building those learning outcome assessment modules. That's too long." He wasn't going to make that mistake twice.

The 4 Steps

1. Talk to dozens of people, not a handful. Adam and his co-founders didn't do 5 or 10 calls. They talked to dozens and dozens of companies. Some they were friendly with. Some they weren't. They got connected through their network. The goal wasn't to pitch. It was to unpack the problem from every angle. They talked to potential customers and audit firms (a key stakeholder they identified early).
2. Pattern-match obsessively. Every day, the co-founders came back together and shared notes. They tracked everything in a Google Doc. Adam said: "You just look at our Google Doc and see it's the same exact words that we're hearing across these conversations." When different people use the same language to describe the same frustration, that's signal.
3. Find the smallest slice. The compliance space (GRC) had been around for decades. It was massive. Adam didn't try to boil the ocean. He asked: what's the lowest-hanging fruit we can solve with our muscle memory? The answer: "An automation-first approach to the C in GRC." Not governance. Not risk. Just compliance automation. That was the wedge.
4. Stay close to early believers. Out of all those conversations, about 12 companies stayed very close during the 6 months of building. They weren't just validating. They were watching, giving feedback, and waiting. When Drata launched, those 12 became the first paying customers. No cold outreach needed.

Real Numbers

Adam's first company, Portfolium, took a different path. He iterated for years with students (who weren't the buyer) before finding the feature universities would pay for. First 5 university customers: brutal to close. The total timeline to meaningful traction: years.

At Drata, the validation phase was 6 months of conversations. Then 6 months of building. 12 first customers on launch day. 100 within 6 weeks. 1,000 within the first year. Same founders. Same execution ability. The difference was knowing exactly what to build and for whom before building it.

When It Fails

This framework breaks when the market is brand new and nobody has the vocabulary to describe the problem yet. If you're creating a category, conversations won't reveal patterns because the patterns don't exist yet. In that case, you need to ship something small and let the market react. Adam's situation was different. Companies already knew SOC 2 was a barrier. They just hated the process.

Your First Move

This week, list 20 people who might have the problem you're solving. Not 5. Twenty. Reach out to 10 of them. Don't pitch your solution. Ask them to walk you through the last time they dealt with this problem. Write down the exact words they use. If 7 out of 10 describe it the same way, you've found your slice.