Staying Liquid: Two Years of Building Bugz

Two years ago, Bugz was a different company with a different name on its slides.

Today it turns two — and I want to mark that the honest way. Not with a highlight reel, but with the version that actually happened: the pitches that went nowhere, the proofs of concept we killed, and the slow, uncomfortable realisation that building the thing was never the hard part.

It's easy to build. It's brutally hard to find fit.

I could build. That was never in question. Give me a problem and I'll ship something that works. What nobody warns you about is that shipping is the easy 20%. The other 80% — finding people who genuinely need what you built, badly enough to pay for it — is a different sport entirely.

And the signals lie to you.

People are kind. They don't want to hurt your feelings, and they especially don't want to spit on something you obviously poured yourself into. So they nod. They say "this is great," they say "send me more," they say "let's stay in touch." Every one of those feels like traction. None of them is a customer.

The hardest skill I had to learn this year was `separating the signal of my own hard work from the signal of product-market fit.` They feel identical from the inside. They are not the same thing. Effort is not evidence.

You need someone who will tell you the truth

The antidote to a hundred polite nods is one person who will look you in the eye and say "this isn't working."

For a solo founder, that person isn't a luxury. They're infrastructure. A mentor — or a friend — who gives it to you straight, who isn't impressed by your effort and isn't trying to protect your feelings, is worth more than a dozen encouraging ones. I was lucky to have them both. They cost me some comfortable illusions, and saved me a year.

Find the person who tells you the truth. Then actually listen to them.

Fail faster and understand what "pivot" really means

We ran two proofs of concept that didn't find their footing. We sunset both.

I won't call them failures. They were `lean fits` fast to build, faster to learn from, and the only reason we found the direction we're on now. The mistake isn't running a POC that doesn't work. The mistake is keeping it alive long after it's told you the answer.

The rule I now hold myself to: `a first paid customer in the first 90 days, or it's a signal and not a setback.` Ninety days is enough time for a real need to surface. If money hasn't moved, the market is telling you something, and the brave thing is to hear it.

And here's the part I underestimated: a real pivot is not a feature change. A pivot is a complete rebrand — new positioning, new story, sometimes a new identity. Half-pivots, where you change the idea but keep the old packaging, fool no one, least of all yourself.

Staying liquid

There's a line from S.W.A.T. I kept coming back to. Hondo, to his team: `stay liquid.`

Water doesn't argue with the shape of the container. It adapts, it finds the gap, it keeps moving. Two years of building taught me that staying liquid isn't indecision — it's the discipline to hold your conviction about the mission while staying completely fluid about the form. Be stubborn on the destination, flexible on the route.

So we changed the route.

Where we landed: an AI-native cybersecurity agency

Bugz is now an `AI-native cybersecurity agency.`

Our focus is cyber resilience for Karnataka's government and its digital public infrastructure, the systems that simply cannot afford to fail. We are do this one step at a time under the guidance of CySecK, Karnataka's K-Tech Centre of Excellence for Cyber Security, IISc.

We're an agency that ships products. Two are live. A third is in active development. And we're preparing to give our infrastructure approach back to the community as an open-source Bugz module. The engagements harden the products; the products make the engagements repeatable.

This is the shape the last two years were trying to find.

Two years, measured honestly

Not vanity metrics — the real shape of building a company:

• 50+ pitches given.
• A pipeline of 100+ cold conversations, 3+ warm, and 1 hot. That's the funnel nobody puts on a slide.
• 2 cohorts selected and completed: CySecK H.A.C.K and T-Hub Rubrix.
• 2 POCs sunset — lean fits, not failures.

And we showed up. In order, the stages we stood on:

1. VulnCon'25
2. BSides Bangalore, 2025
3. CSA CyBe, 2025
4. Bengaluru Tech Summit, 2025
5. DSCI AISS, New Delhi, 2025
6. BFI, Mumbai, 2026
7. Nullcon '26, Goa
8. CySecK Annual Conference, IISc, 2026

What's next

Year three is about turning one hot lead into a reference, two products into a category, and a research-led approach into resilient infrastructure that the state — and eventually others — can rely on.

We'll keep staying liquid. The mission doesn't move. Everything else can.

Thank you to everyone who told us the truth, sat through a pitch, or backed the work when it was still finding its shape. Here's to year three.

`— Shekhar Gowda, Founder, Bugz`