Your thesis is the methodology. Sell the review in Week 1.

AI/LLM Security Review, deep spec. Production-ready offer, sales copy, and operations kit for the Wk 1 to 12 wedge. Pulls the AI/LLM Review out of position 3 in your stack and makes it the lead offer for the first 12 weeks.

Status: READY TO SELL WEEK 1. Delivery competence: HIGH (Sebastian's thesis covers this domain). This file is the production spec, sales copy, and operations kit for that offer.

Why this is the wedge

The market is mid-panic about AI security. Every quarter brings a new prompt-injection news cycle (the Bing Chat sidney leaks of 2023, the Samsung ChatGPT data-leak ban of 2023, the agent-hijacking demos of 2024 to 2025, the indirect-injection attacks against email-summarising agents of 2025). SMB SaaS founders are shipping AI features faster than they are learning to secure them. OWASP published its LLM Top 10 in 2023 and refreshed it in 2025, but the framework is barely known outside enterprise security teams. Series A diligence checklists increasingly include some version of "did you test the AI feature?" and founders have no good answer.

The supply side has not caught up. The enterprise tier (Trail of Bits AI/ML practice, NCC Group AI assurance, HiddenLayer, Robust Intelligence) charges $25k and up for an engagement, with 4 to 8 week lead times and SOC-2-style scope. The DIY tier (open-source frameworks like Promptfoo, Garak, PyRIT) is free but assumes the buyer has an in-house security engineer who can run them and interpret results. There is no productized middle for sub-$10M-ARR SaaS founders who want a credible third-party review in days, not months, for low four figures rather than five. That gap is Sebastian's lane.

Combine that with his business-administration and tax-accounting fluency (rare in the security world) and he can talk to a non-technical founder about AI risk in P&L terms without losing them. That combination is genuinely scarce in May 2026.

The compounding case is the kicker. Every review he ships produces a sanitized public write-up that anchors his LinkedIn authority. By month six he is the named guy for this work in his target buyer's network. By month nine he has a retainer client base that pays for the slower pen-test skill build behind the scenes. The wedge is the offer, but it is also the marketing engine and the curriculum runway.

The offer (verbatim, for his website)

Scope, what is IN

• ONE production AI feature on ONE URL or endpoint
• Manual plus tool-assisted testing against the OWASP LLM Top 10 (2025):
  • LLM01 Prompt Injection (direct and indirect)
  • LLM02 Sensitive Information Disclosure
  • LLM03 Supply Chain (model and library provenance check)
  • LLM04 Data and Model Poisoning (exposure assessment, not full audit)
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency (for agentic features with tool access)
  • LLM07 System Prompt Leakage
  • LLM08 Vector and Embedding Weaknesses (for RAG-backed features)
  • LLM09 Misinformation (UX and grounding risk)
  • LLM10 Unbounded Consumption (rate-limit and cost-amplification testing)
• Authentication and rate-limit testing at the AI endpoint
• Output sanitisation testing (XSS via LLM-generated markdown is a recurring SMB issue)
• 1-hour live remediation call with technical and executive audiences
• Single round of free re-test on critical or high findings within 30 days

Scope, what is OUT (and why)

• Full web app pen-test (separate offer, Productized Audit at $1.5k to $3.5k or Pen-Test at $3.5k to $12k)
• Mobile app testing (different OWASP guide, separate skill)
• Infrastructure pentest (network, cloud, AD, separate domain)
• Source code audit (separate offer, hourly)
• Compliance certification work (SOC 2, ISO 27001, HIPAA attestation, refer out)
• Custom fine-tuned model attacks (research engagement, not productized)
• Adversarial ML attacks on model weights, extraction attacks on closed-weight providers (research engagement)
• Fix implementation (advisory only, client engineers implement)

The 3-day delivery process

Day 1 (4 hours of billable work)

• 30-minute kickoff call. Client demos the AI feature live. Sebastian confirms scope, captures the system prompt if the client is willing to share, gets test credentials.
• 60 minutes of recon. Map the AI feature's surface: endpoints, prompt templates exposed in front-end JS, model used, plugin or tool calls, rate-limit posture, output rendering path.
• 2.5 hours on LLM01 to 05 testing. Direct prompt injection payloads (jailbreak suites, role-confusion, instruction override). Indirect injection via any user-controlled input that ends up in the prompt context (document upload, URL fetched by the agent, RAG corpus). Sensitive information disclosure probes (system prompt extraction, training data echo, customer data leak between sessions). Supply chain check on the model provider, framework versions, and any third-party plugins. Data and model poisoning exposure assessment.

Day 2 (4 hours of billable work)

• LLM06 to 10 testing. Excessive agency tests on any tool-using feature (can the LLM be tricked into calling unintended tools, passing unsafe parameters, or chaining actions outside scope). System prompt leakage attempts via standard extraction prompts. Vector and embedding weaknesses for RAG features (corpus poisoning, embedding inversion exposure, cross-tenant retrieval leakage). Misinformation and grounding UX walkthrough. Unbounded consumption testing (token-bomb prompts, recursive agent loops, cost amplification through long-context requests).
• Re-test all confirmed findings to rule out false positives.
• Start drafting the report.

Day 3 (4 hours of billable work)

• Complete the report. Each finding gets severity rating (CVSS 3.1 with business-context adjustment), reproduction steps with screenshots or curl commands, business impact translated for a non-technical reader, and remediation guidance with code-level pointers where relevant.
• 1-hour remediation call. Walk the client through every finding. Answer questions. Hand over the final PDF and a sanitised version the client can share with auditors or investors.

Total: 12 billable hours over 3 calendar days. At a $1,500 fixed price that is $125/hour effective on the launch offer, rising to $208/hour at the standard $2,500 tier and $291/hour at the premium $3,500 tier.

Pricing logic

The launch discount is deliberate. The point is not the margin in month one; it is filling the calendar fast enough to have three case studies by Week 10 and six by Week 16. Geographic arbitrage means even the launch tier is profitable from Chiang Mai.

Raise rates after every third engagement until win-rate drops to ~80%. That is the equilibrium price for the offer at that time.

Buyer profile (the 3 archetypes that buy this)

Sebastian's German-speaking edge matters most for Archetype C. The DACH compliance market is large, awareness of AI risk is rising fast, and English-only consultants face real friction with German regulators and procurement teams.

How Sebastian sells this (3 outreach hooks, production-ready)

These are not templates. They are first-touch emails Sebastian can send today with a name and a real observation swapped in. Each one assumes 5 to 10 minutes of recon on the target before sending.

Why he will not fail at delivery

• His thesis covered exactly this domain. He has 6+ months of head-time in the literature.
• The OWASP LLM Top 10 (2025) is publicly documented with worked examples and remediation guidance for every category.
• Manual testing dominates the methodology. There is no specialty tool he has to learn before Week 1, and the open-source helpers (Promptfoo for regression-style payload suites, Garak for automated red-team prompts, the OWASP cheatsheet repository on GitHub) are all free and well-documented.
• The 3-day fixed scope caps the blast radius if he misjudges complexity on a particular engagement.
• He has the option to refund and write-off the engagement if a finding surfaces something genuinely beyond his depth. Once, as a reputation insurance policy, not as a habit.

The risks, what could blow up, and the mitigation

What to ship Week 1 (concrete TODO)

1. Pick the domain. tagwercher.io OR tagwercher.com. Buy whichever is missing, redirect to whichever is primary. Resolve the inconsistency before any outreach goes out.
2. Write the offer page on the chosen domain. The verbatim block above is ship-ready copy; drop it into a Carrd, Astro, or plain HTML page with a contact form.
3. Draft sample-llm-audit-report.md, render to PDF, host at /sample-report.pdf on the same domain. Use a fake target (OWASP Juice Shop's AI plugin, or a public demo chat from a well-known unrelated company). 20 pages. The single most important sales asset.
4. Rewrite the LinkedIn headline. Lead with "AI/LLM Security Reviews for SaaS founders, OWASP LLM Top 10, 3-day turnaround." Subtitle the rest of the offer stack underneath.
5. Build the first outreach list. 50 named AI SaaS startups. Sources: Product Hunt new AI launches for the past 60 days, YC W25 and S25 batch list, AI Tinkerers Discord member roster (carefully, for names not bulk), three Series A AI announcements from the past month. Capture name, company, AI feature URL, observable finding (from 5 minutes of recon).
6. Send the first 10 free-finding emails by end of Week 1. Use Hook 1 verbatim with real observations swapped in. No spintax, no automation, no Instantly. Personal Gmail or Proton, hand-sent.
7. Set up payment infrastructure. Stripe or Wise Business invoice link. SOW template (use Appendix B from the curriculum as a starting point, drop in the AI/LLM scope language from this file).
8. Get cyber liability insurance quote. Hiscox (UK and EU), Embroker (US), or a German broker. ~$60 to $150/mo. Bind the policy before invoicing the first engagement.

Decisions Sebastian needs to make in Week 1

• Domain. tagwercher.io or tagwercher.com. Pick one as canonical, redirect the other.
• Legal entity for invoicing. German Einzelunternehmen if mostly EU clients, US LLC (Wyoming or New Mexico) if mostly US clients, Thai BOI is hardest and only worth it for long-term Thai-tax-residency reasons. Talk to a tax advisor familiar with German-Thai DTV residency before committing.
• Cyber liability insurance broker. Hiscox (UK and EU, well-priced for early-stage consultants), Embroker (US-focused), or a German alternative if invoicing as Einzelunternehmen. Bind before first engagement.
• Positioning language. English-only or English plus German. He is a native German speaker. The DACH market is a real opportunity (Archetype C above). Recommendation: lead the website in English, add a "Auch auf Deutsch verfuegbar" line near the CTA, switch the deliverable language to German on request for a $300 surcharge.
• Sample report target. Pick one fake or public-demo target for the sample report and stick with it. Recommendation: OWASP Juice Shop's AI plugin (deliberately vulnerable, no permissions needed, well-known in the security community so the report demonstrates competence rather than raising eyebrows).

The compounding marketing engine attached to this offer

Every engagement produces three artefacts:

1. The client-private full report (their property, never shared)
2. A sanitised public write-up, 800 to 1,200 words, framed as "common AI feature security gaps in 2026 SaaS" rather than naming the client
3. One LinkedIn post (250 to 400 words) drawn from that write-up

By Week 12 he has six sanitised write-ups. By Week 26 he has 13. Every write-up ranks for long-tail terms ("prompt injection testing for SaaS", "OWASP LLM Top 10 audit fixed price", "AI chatbot security review") that almost no other independent consultant is publishing about in May 2026. The combination of niche authority, productized pricing, and a real public portfolio is what compounds him out of the cold-outreach grind by Month 4 to 5.

This is also what unlocks the retainer offer (his Offer #4 in the original business plan). A client who buys a $1,500 review, finds two critical issues, fixes them, and wants ongoing eyes on the AI feature is a natural $1,500 to $2,000/month retainer conversation by Engagement 2 or 3.

How this changes the 26-week curriculum (suggested)

His original curriculum treats Phases 1 to 4 (Weeks 1 to 20) as prerequisite to invoicing. That is true for the web app pen-test offer. It is not true for this offer. The skill is already there from his thesis.

Suggested revised sequencing:

• Weeks 1 to 4 (Phase 1, Foundations): continue as planned. HTTP, Linux, Python, Burp. Parallel track: ship the offer page, sample report, contracts, insurance. By end of Week 4, the AI/LLM offer is fully live.
• Weeks 5 to 10 (Phase 2, PortSwigger Academy): continue as planned, but reserve 4 hours per week for outreach (10 to 20 emails) and first engagements. PortSwigger's Web LLM Attacks topic in Week 9 directly reinforces the live offer.
• Weeks 11 to 15 (Phase 3, Methodology): continue as planned. Engagement learnings feed back into the methodology document.
• Weeks 16 to 20 (Phase 4, PNPT): continue as planned. By now the AI/LLM offer is the income floor; the pen-test offer is the upsell that the cert credentialises.
• Weeks 21 to 26 (Phase 5, Client Acquisition): now becomes Phase 5 for the BROADER offer stack. The AI/LLM book of business is already there.

Net effect: instead of "first paid engagement signed Wk 20 to 26" (original plan), it becomes "first paid engagement signed Wk 4 to 6, second by Wk 8, third by Wk 10". By Wk 26 he has a small portfolio and a credentialled pen-test offer, not a credentialled pen-test offer and zero portfolio.

What done looks like (the acceptance criteria for this wedge)

• Offer page live at /ai-llm-security-review on the canonical domain
• Sanitised sample report PDF downloadable at /sample-report.pdf
• LinkedIn headline rewritten to lead with the AI/LLM positioning
• First 10 free-finding outreach emails sent by end of Week 1
• First paid engagement signed by end of Week 6 at the latest
• Cyber liability insurance bound before the first engagement starts
• SOW template finalised with the AI/LLM scope language baked in
• Three sanitised public write-ups published by end of Week 12
• Standard pricing raised to $2,500 after the third engagement is delivered
• Premium pricing raised to $3,500 after the sixth engagement is delivered

When all ten boxes are ticked, the wedge has done its job and the broader offer stack (productized audit, full pen-test, retainer) inherits an audience that already trusts him.