About the Founder Field Guide
Why this exists, who I am, and what I am building.
Why this exists
Most founder content is either victory-lap or doom-scroll. There is very little in between that is honest about what the first year actually feels like.
The Founder Field Guide is the thing I wish someone had handed me on day one. Not a playbook. Not a course. A field guide. The kind of document you read in the middle of a bad week and find one paragraph that helps you decide what to do tomorrow.
Everything in here comes from real decisions, real mistakes, and the operators, advisors, and fellow founders who have helped me along the way.
About me
I'm Ivan Rahman, founder and CEO of Avistar, an early-stage cybersecurity company.
Before Avistar, I spent years in financial operations leadership at a large enterprise, where I worked across hundreds of APIs and critical systems supporting massive daily transaction flow. That experience is the reason this company exists. When you sit close to operations like that long enough, you watch how machine credentials accumulate. You watch how identity governance breaks at scale. You watch the gap between what security teams think is happening and what is actually running in production.
Avistar is the answer to that gap.
About Avistar
We build a non-human identity discovery and risk-scoring platform for cloud environments.
In plain language: every modern company runs thousands of machine accounts, service principals, API keys, and agentic identities that no one is actively governing. Most security teams cannot tell you how many they have, who owns them, or which ones are dangerous. We can.
This is the new attack surface. As agentic AI puts more non-human identities into production at every company, the gap between what is deployed and what is governed is widening, not closing.
We sell primarily through the MSP and MSSP channel because that is where mid-market security actually lives. We are read-only, plug-and-play across major cloud and identity providers, and priced to be the entry point rather than the enterprise gate.
One year in: notes from 0 to 1
A few things I did not understand a year ago that I understand now.
The hardest part is not building. It is choosing what not to build. Every founder I respect has told me this. I did not believe them until I lived it. The pull to add features, chase deals, take meetings, and explore tangents is constant. The discipline to stay narrow is the actual job.
Distribution beats product, almost always. A mediocre product with a real channel will outperform a brilliant product with no path to the customer. Pick your distribution before you pick your roadmap.
Your first paying customer changes your company. Not because of the revenue. Because the conversation shifts from "we think" to "we know." Get there as fast as you can, even if the contract is small and the product is rough.
Investors are not customers. A great pitch meeting is not a great signal. A signed PO is. I spent too long optimizing for investor feedback in the early months. The market tells you the truth faster.
The advice you get is shaped by the room you are in. Different operators, different coasts, different functions will give you different answers to the same question. All of them will be partly right. Triangulate, do not delegate.
You will be wrong about your ICP. Repeatedly. The customer you build for in month one is rarely the customer you sell to in month nine. Stay close to actual conversations and update fast.
Cash discipline is identity discipline. How you spend money in the early months tells you who you are. Stretching a small round into a long runway is rarely glamorous. It is almost always necessary.
Most days are not heroic. Most days are unanswered emails, a deck that needs another revision, a partner call that ran long, and one decision that you will only know was right or wrong six months from now. The mythology of the founder journey skips this part. The actual work happens here.
How to think about being a first-time founder
A few mental models that have held up for me:
Treat the first year as a research project. You are not running a company yet. You are running an investigation into whether a company should exist. The faster you accept that framing, the faster you stop performing and start learning.
Optimize for learning rate, not output rate. Two founders can ship the same number of features in a quarter and end up in completely different places, depending on what they learned. Track the learning, not the activity.
Default to writing. Pitch decks, one-pagers, internal memos, customer emails. The act of putting something in writing exposes whether you actually understand it. If you cannot write it clearly, you do not yet think clearly about it.
Keep your circle small and direct. A few people who will tell you the truth are worth more than a hundred who will not. Build that circle deliberately.
Hold the long arc, plan the short arc. A ten-year vision keeps you oriented. A 90-day plan keeps you executing. The middle range, the one-to-three-year plan, is where most founders waste energy.
You are the bottleneck, until you are not. In year one, almost every constraint runs through you. The job is to gradually engineer yourself out of as many of those positions as possible, without losing the things only you can do.
Get in touch
If you are a founder, advisor, or operator with feedback on the field guide, I would like to hear it.
If your company offers a service or community that could help founders, and you are interested in sponsoring or contributing a resource, please reach out:
This is a working document. It will get better with input from people who have walked this road.