Week of 13–19 July 2026 · ISO 2026-W29 · 4 daily reports + 1 Research-Hour report synthesised
This week's research produced a genuine strategic sharpening: the generic "AI/GEO audit" framing converged on a specific, defensible AI-tool / AI-agent security audit service — driven by a dense cluster of Hacker News security stories (Cursor 0day 388pts, Claude secret-leak 641pts, AI voice fraud 176pts, MS 570 flaws) that hit exactly the doctor + security-domains + AI-engineering intersection.
Signal-drivenThe shift was not editorial — real market signals picked the wedge. The barbell strategy (fast-cash service → security-product moat) held for the 3rd straight week. A new asset class surfaced (property lead-gen portfolio). Pipeline health is degrading: 3 missing days, expired Claude CLI OAuth, broken affiliate scraper (0/7 niches for 2 weeks).
Fastest cash£1k in 2–4 weeks£1.5k–10k+/mo
Appeared in all 4 daily reports. The single most recurring opportunity, sharpened this week from generic "GEO audit" to a specific AI-tool / AI-agent security audit (Cursor, Copilot, Claude-agent config reviews). Package a branded PDF checklist, offer free 30-min assessments to UK law/fintech/SaaS teams using the live HN stories as the cold open. Convert to £300–800/mo retainers.
£1k in 4–10 weeks£300–10k+/mo MRR70%+ margins
Appeared in all 4 daily reports. Three converging shapes: (a) Chrome extension — password strength/breach checker, freemium + affiliate links, lowest build cost; (b) Micro-SaaS — breach exposure checker, Cyber Essentials generator, SPF/DMARC scanner paid tier; (c) On-device "Private AI" app enabled by Bonsai 27B phone-model release (624 HN pts). The 15+ owned security domains give free pre-owned distribution.
£500–5k/moLow effort/unit3–12 weeks to first £
Appeared 3 of 4 days + Research-Hour. Scale-out on sunk costs: AI-built affiliate comparison pages ("Best Password Managers UK 2026") on security domains with recurring commissions; focused KDP series in large-print/medical-niche; clone a white-label AI SaaS from the MIT-licensed awesome-generative-ai-apps repo (50+ pre-wired products with auth + Stripe).
| Date | Report | Pipeline | Notes |
|---|---|---|---|
| Mon 13 Jul | ✅ 13 KB | Claude CLI | 3 opps |
| Tue 14 Jul | ❌ | — | cron did not run |
| Wed 15 Jul | ✅ 21 KB | Manual research | 5 opps — richest report |
| Thu 16 Jul | ⚠️ 32 KB | Direct — CLI OAuth expired | 5 opps + Research-Hour |
| Fri 17 Jul | ✅ 14 KB | Auto-research | 3 opps |
| Sat 18 Jul | ❌ | — | cron did not run |
| Sun 19 Jul | ❌ | — | cron did not run |
⚠️ Nothing built, launched, or earned revenue this week. Third consecutive week without execution. Affiliate scraper returned 0/7 niches (broken, not empty). Trend-intel tool running blind.
Build a one-page "AI-Tool Security Audit" checklist (Cursor/Copilot/Claude-agent config, prompt-injection, secret-leak surface). Offer free 30-min assessments to 5 UK SaaS/law/fintech contacts. Open every conversation with the Cursor 0day or Claude secret-leak story. Price: £500–1,500 paid audit; £300–800/mo monitoring retainer.
Target: First free assessment delivered within 1 week, first paid audit booked within 2.
Pick the Chrome extension (password strength/breach checker, freemium + affiliate links). Brand on best security domain. ~2–4 day MVP with AI. Also stand up 2–3 affiliate comparison pages (Bitwarden 30% recurring, Proton Pass) seeded from traffic-thief competitor sitemaps. FTC/ASA disclosure from day one.
Security MCP Server (Research-Hour's genuinely novel, portfolio-fitting idea — first-mover gap, but secondary to cash). Skip: faceless video, on-device app rebuild, standalone domain-flipping.