1The market problem
Every company running LLM inference at scale has a cost line growing faster than revenue. Some of that growth is legitimate. Some of it is someone else monetizing their tokens.
| Layer | What it is | Examples |
|---|---|---|
| Relay market | Open-source OpenAI-compatible gateways repurposed as commercial transfer stations | one-api, new-api |
| Credit marketplaces | Sites brokering unused startup credits | AI Credits, AICreditMart |
| Bulk-discount routers | Claim "bulk pricing," likely acquiring supply elsewhere | CheapCredits, Tokvana, Neokens |
| Direct brokers | Individuals offering $100k/day in spend via email and Telegram | unnamed |
| Message boards | Reddit and Telegram channels moving credits | r/saasforsale, r/indiehackers |
97.8%
max discount off official rates
$59
buys $3,333 of Anthropic credit
3.6M
monthly visits, top ten relays
10M+
credits in circulation (est.)
Why this is a GTM opportunity
The market is real and documented, and most buyers have no idea it touches them. That makes it a category that has to be taught before it can be sold.
2Who we sell to
The pain scales with inference spend, so we segment by monthly LLM spend.
Tier 1: AI-native companies, highest intent
Inference is the core cost of goods, so reseller traffic directly inflates COGS and margin is existential.
| Tier | Profile | LLM spend | Entry point |
|---|---|---|---|
| 1 | AI-native companies: inference is the core cost of goods | $50k–500k+/mo | Founder or Head of Engineering |
| 2 | Established SaaS adding AI features: cost center not yet owned | $10k–100k/mo | VP Engineering or CFO |
| 3 | Model providers and API platforms: resellers steal their revenue | n/a: they are the supply | Trust & Safety, Fraud, Platform |
| 4 | Marketplaces and aggregators: reseller traffic shows up as buyer behavior | n/a | Risk / Trust & Safety |
3Positioning
Category
LLM abuse and fraud detection. The incumbents sit in API security and bot management, where buyers believe they're already covered. This category is unclaimed.
Positioning statement:
For companies running LLM inference at scale, Vectoral is the abuse detection layer that catches resellers, stolen keys, and free-tier farming before they hit your invoice, fusing browser signals and account signals into one verdict. Unlike bot-management tools that only see the client, Vectoral sees the account and the client together.
Three proof pillars
Pillar 1
Research credibility. The relay market research is the category definition. Lead with it in every conversation.
Pillar 2
Deployment flexibility. Hosted or self-hosted Docker in the customer's VPC. Critical for security buyers.
Pillar 3
Fused signals. Browser sensor plus backend account signals, combined into one verdict.
Objection handling
| Objection | Response |
|---|---|
| "We have Cloudflare / bot management" | Those see the client. Resellers use real browsers. You need the account signal too. |
| "We'd know if someone was stealing our tokens" | The research shows 3.6M monthly visits across ten relays. You wouldn't. |
| "We can't send traffic to a third party" | Self-hosted Docker in your VPC. Your traffic never leaves. |
| "Our spend is fine" | Show them the free-tier farming pattern. Most companies have it and don't know. |
| "Too early, we'll revisit" | Every month of delay is a month of leakage. Quantify it in their numbers. |
4Channel strategy
Three channels, in priority order.
Channel 1: Signal-based outbound
Small and signal-driven. Every account earns its place on the list.
| Signal | Why it matters | Where to find it |
|---|---|---|
| Hiring AI/ML engineers | Scaling inference = scaling exposure | Job boards, LinkedIn |
| Public LLM cost complaints | Pain is conscious | HN, X, Reddit |
| Recent funding round | Budget plus scaling pressure | Crunchbase, TechCrunch |
| Launching a free tier | Free-tier farming risk | Product pages, PH launches |
Using one-api / new-api | Already in the relay ecosystem | GitHub stars, dependency graphs |
Volume target
40–60 highly-qualified accounts per month.
Channel 2: Partner and ecosystem
Cloud marketplaces
AWS, GCP, Azure listings. Security buyers have committed spend and procurement already approved.
AI infrastructure
Observability (LangSmith, Helicone), gateways (Portkey, LiteLLM), vector databases. Complementary, not competitive.
Resellers & MSSPs
They sell to the same buyers.
Investor portcos
Restive and Sterling Road portfolio companies are warm introductions.
Channel 3: Community presence
Hacker News comment threads on AI cost and abuse · r/LocalLLaMA, r/netsec, r/cybersecurity · AI engineering Discords and Slacks · conference talks at RSA, Black Hat, AI Engineer Summit.
5Outbound motion
The core insight
Nobody believes they have a token-reselling problem, so we don't ask them to. We ask for 15 minutes to show them what we found in their own traffic.
Sequence: 6 touches over 14 days
- Day 1 · EmailReference their specific signal, the research, and offer an exposure read.
- Day 2 · CallOne call, one voicemail. Reference the email and the research by name, restate the 15-minute exposure read, and follow up by email either way.
- Day 3 · LinkedInConnect with a one-line note referencing the same signal.
- Day 5 · EmailSend the relevant research piece. No ask.
- Day 8 · EmailOne specific pattern from their stack: free tier, gateway, volume.
- Day 14 · EmailBreakup: "closing the loop, here's the research, reach out anytime."
Non-negotiable rules
- Every email references something specific about them. Nothing that could go to anyone else.
- Research earns the meeting. The product pitch comes later, if at all.
- Never say "I'd love to pick your brain." Ask for a specific 15 minutes.
- One CTA per touch: a 15-minute exposure read, on the call and in every email.
The offer that converts: free exposure read
Run their public endpoints through our detection and show them what reseller traffic looks like against their own traffic.
Costs nothing, proves the product, and creates urgency. It turns an abstract threat into their own data.
6Sales process
| Stage | Definition | Exit criteria |
|---|---|---|
| 1. Identified | Signal detected, account qualified | ICP fit confirmed, entry point identified |
| 2. Engaged | Reply received, conversation open | Exposure read scheduled |
| 3. Exposure read | Delivered findings from their traffic | Problem confirmed in their data |
| 4. Discovery | Technical and business requirements | Champion identified, budget confirmed |
| 5. Evaluation | Trial or pilot running | Success criteria defined and met |
| 6. Proposal | Pricing and terms presented | Procurement engaged |
| 7. Closed | Contract signed | Onboarding scheduled |
Target cycle
45–75 days from engaged to closed.
Qualification
| What we need to know | Why it matters |
|---|---|
| Leakage in dollars | Sizes the problem in their terms |
| Budget owner | Who owns the inference line item |
| Requirements | Security review, procurement, legal |
| Decision process | Who signs, and on what timeline |
| Paperwork | MSA, DPA, security questionnaire |
| Pain confirmed | Verified in their own traffic data |
| Champion | Someone inside who wants this to happen |
| Alternatives | What else they're evaluating, including doing nothing |
7Metrics
Activity metrics are what the motion is steered by. Revenue targets come later, once we have our own ARR, ACV, and inbound volume. See open questions.
| Leading indicator | Weekly target |
|---|---|
| Qualified accounts touched | 40–60 |
| Reply rate | 8–12% |
| Positive reply rate | 3–5% |
| Exposure reads delivered | 8–12 |
| Research pieces published | 1 per month |
8First 90 days
Days 1–30: Foundation
- Audit the current pipeline, CRM, and any existing inbound
- Build the ICP list: 300 target accounts across the four tiers
- Stand up the outbound stack: enrichment, sending, CRM pipeline
- Write the messaging: three value props tested against 20 accounts
- Ship the exposure-read offer and deliver the first five
Days 31–60: Motion
- Run the full outbound sequence at 60 accounts per month
- Deliver 10 exposure reads and measure conversion
- Open the partner channel: five cloud marketplace listings, ten AI infra intros
- First closed deal
Days 61–90: Scale
- Double outbound volume if reply rate holds above 8%
- Build the objection-handling doc from real calls
- Write the sales playbook from what actually worked in the first 60 days
9Open questions
To sharpen this playbook
- Our current ARR and customer count: sets what a realistic Year-1 revenue target looks like
- Our ACV today: is it $20k or $100k? That changes the deal math entirely
- How much demand our research generates today: inbound volume is the half of the funnel we can't yet size
- Which deployment customers actually choose: self-hosted or hosted, and how that affects pricing
- What's already in our pipeline: anything in flight to build on
- Who else shows up in our deals: competitive landscape as buyers see it