Long-horizon business incubation and consulting

Search the site
Start a readiness review
Start a readiness review

Resources

Research briefs

Four designed reports with methodology, limitations and sources: security, accessibility, staffing models and SaaS metrics, for founders building software.

Start a readiness review
Each research brief gathers the public evidence on one question into one bright point.

These briefs are short reports for founders who need a defensible answer to a practical question. Each one states its method, names what it could not verify, lists its sources, and ends with an appendix you can use: a checklist, a decision matrix or a formula table. Each prints cleanly.

How the briefs are made

Three of the four briefs report what public primary documents state, such as the OWASP Application Security Verification Standard, the NIST Secure Software Development Framework, the W3C Web Content Accessibility Guidelines and the US Department of Justice web rule. The staffing brief is analysis and says so. The metrics brief carries formulas, never benchmarks.

Every factual statement carries a reference to a numbered source, and every brief is dated “as of” the day its sources were read, so you can judge how current it is. Where a source could not be read in full, the brief says so under Limitations and leaves the detail out rather than guessing.

What the briefs are not

They are not legal, audit or compliance advice, and they do not describe controls operated by World Enterprise Group Incorporated or any other company. They contain no client results.

The research briefs

  • Source-based, with analysis

    Security baseline for year one

    What a first-year SaaS security baseline can draw from OWASP ASVS, NIST SSDF and the AICPA Trust Services Criteria, and how to sequence the work.

    Version 1.0, as of October 6, 2026. 5 sources, 5 min read.

  • Source-based, with analysis

    Accessibility at launch

    A source-based reading of WCAG 2.2, Section508.gov and the DOJ ADA Title II web rule, with a labelled analysis of why accessibility belongs in launch scope.

    Version 1.0, as of October 6, 2026. 5 sources, 5 min read.

  • Analysis, no statistics

    Team, agency or freelancers

    A criteria-based decision framework for choosing between a dedicated team, an agency and freelancers, with the legal basics that apply to each.

    Version 1.0, as of October 6, 2026. 5 sources, 6 min read.

  • Definitions and formulas

    SaaS metrics definitions

    Definitions and a formula appendix for MRR, ARR, churn, NRR, CAC and LTV, drawn from public references, with a reporting discipline and no benchmarks.

    Version 1.0, as of October 6, 2026. 5 sources, 5 min read.

Four reports, four worlds

Each report has its own cover: a world drawn from its title, so the same report always looks the same wherever it is linked.

Accessibility: what the web gets wrong, and when rules apply

Automated tests found WCAG failures on almost every one of the top million home pages, and six kinds of error account for nearly all of them. The rules behind the obligation arrive on fixed dates.

The most common detected WCAG failures
Show the figures as a table
The most common detected WCAG failures
GroupShare of home pages
Low contrast text83.9%
Missing alternative text for images53.1%
Missing form input labels51%
Empty links46.3%
Empty buttons30.6%
Missing document language13.5%

Automated tests detect only part of WCAG; the share of pages that fully conform is lower still.

Source: WebAIM, The WebAIM Million , February 2026

Standards and rule dates

  1. Section 508 refresh published The Access Board final rule references WCAG 2.0 for federal agencies. Source: Section508.gov, Laws and policies
  2. Section 508 refresh takes effect Applies when agencies develop, procure, maintain or use technology. Source: Section508.gov, Laws and policies
  3. DOJ Title II web rule published State and local governments; adopts WCAG 2.1 Level AA. Source: U.S. Department of Justice, ADA.gov, the 2024 web rule under Title II
  4. WCAG 2.2 Recommendation Adds criteria such as 2.4.11, 2.5.7, 2.5.8 and 3.3.8. Conforming to 2.2 also meets 2.0 and 2.1. Source: W3C, Web Content Accessibility Guidelines (WCAG) 2.2
  5. Interim final rule moves the dates Reported by secondary summaries; verify the current rule. Source: Federal Register document 2026-07663, as reported by secondary summaries
  6. Compliance date, larger entities Populations of 50,000 or more, per the reported interim rule. Source: Federal Register document 2026-07663, as reported by secondary summaries
  7. Compliance date, smaller entities Smaller entities and special districts, per the reported interim rule. Source: Federal Register document 2026-07663, as reported by secondary summaries
Not legal advice. Dates after 2024 rest on secondary summaries; check the current rule.

Security: three documents, three jobs

A test plan, a process vocabulary and a reporting frame. Buyers ask for them because suppliers are a growing part of their own breaches.

How the three documents stack

  1. AICPA Trust Services Criteria Reporting frame

    How will an outside CPA describe our controls to a customer? Decide later and separately.

  2. NIST SP 800-218, the SSDF Process vocabulary

    How should the way we make software reduce vulnerabilities? Names the team’s habits.

  3. OWASP ASVS Test plan

    What must the application itself do, and how is that tested?

Analysis from the security baseline report: start at the base, decide on attestation last.
Breaches with a third party involved
Show the figures as a table
Breaches with a third party involved
GroupShare of breaches
2024 report15%
2025 report30%
2026 report48%

Breaches in the Verizon dataset for each edition; the 2024 point is the 2025 release saying the share doubled to 30%.

Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary , 2026 edition

Teams and metrics, drawn

No team model wins on every criterion, and no metric means anything until its formula is written down once.

Three ways to staff the work, ten criteria

Editorial judgment from the brief, not a measurement. WE steers dedicated teams, one of the three models, so weight the criteria for your own situation.
Criterion FreelancersAgencyDedicated team
Control of method Stronger Weaker Mixed
Continuity Weaker Mixed Stronger
Accountability Weaker Stronger Stronger
Management load on you Weaker Mixed Stronger
Scaling Mixed Mixed Stronger
Breadth of skills Weaker Stronger Stronger
Ownership of work Mixed Stronger Stronger
Security acceptance criteria Mixed Stronger Stronger
Cost clarity up front Mixed Stronger Weaker
Exit Stronger Mixed Mixed

Net revenue retention, as a bridge

  1. Beginning recurring revenue
  2. plus Revenue from upgrades
  3. minus Lost from downgrades
  4. minus Lost from churn
  5. Recurring revenue from the same customers at the end

NRR = [(beginning recurring revenue - MRR lost from churn - MRR lost from downgrades + revenue from upgrades) / beginning recurring revenue] x 100

A schematic of the formula as Stripe publishes it: bar heights are illustrative, not data. Existing customers only; new customers never enter it.

Four figures behind the reports

95.9% 1

of the top one million home pages had detected WCAG 2 failures in 2026, up from 94.8% in 2025

56.1 1

detected accessibility errors per home page, on average

31% 2

of breaches began with the exploitation of a vulnerability, now the most common way in

62% 2

of breaches involved the human element

  1. WebAIM, The WebAIM Million , February 2026
  2. Verizon, 2026 Data Breach Investigations Report, Executive Summary , 2026 edition

These figures describe the wider industry, not WE's results.

Start a readiness review

Tell WE where the company stands. WE replies to arrange a conversation and a written read of your company's timeline.

Start a readiness review Get the timeline brief

A short PDF of the charts and sources, sent by email to the address you give.

Talk to WE : A question that does not fit a form.