I have been doing this exercise a lot lately. Sit with someone at a regulated enterprise. Walk them through the signals their company is putting out — the services they are using, the standards they are participating in, the tooling that is in flight. Talk through what is in active use, and what is conspicuously absent.
It is the absence side that reveals the most. Not because absence is failure, but because in a heavily regulated company, “we are not using that” is rarely a choice. It is a constraint. There are tools they could not adopt if they wanted to. Vendors they could not sign with if procurement opened tomorrow. Open-source projects they cannot run in production until something upstream gets sanctioned. Categories of integration that are simply off-limits until a cornerstone vendor offers a sanctioned version of the same capability.
That kind of company does not need a signals framework that asks what are you using and what are you not. They need a third bucket.
What the first two buckets get right
A two-bucket framing is honest about activity. What is in use today, what is not. It works well for companies that have full agency over their stack. A mid-market company looking at its options has real choices in front of it. The question of “what should we add, what should we sunset” maps cleanly onto the two buckets, because anything that is not used today could plausibly be used tomorrow.
For that audience the framing is enough. The signals show what is there. The story tells what is missing. The next step is obvious.
The two-bucket framing breaks the moment you sit with someone whose stack does not have full agency. Walled-garden enterprises — large regulated organizations, defense, parts of finance, parts of healthcare, parts of government — operate inside a tighter envelope than most people realize from the outside. The procurement gates are slower. The compliance gates are wider. The legal gates are deeper. And the cornerstone vendor relationships are loadbearing in a way that does not show up in a logo cloud.
If you tell someone in that role that they “should be using” a tool that has not made it through any of those gates, you are not being helpful. You are showing that you do not understand the constraint they are operating inside.
The third bucket: what is even possible
The third bucket is the one that respects the constraint while still being useful.
For a regulated organization at full lockdown, the relevant question is not what are you using and what are you not. It is what is even possible from where you stand today. Given the procurement timeline, the compliance posture, the existing cornerstone vendors, the regulators in the room, the auditors in the closet, and the data classification of the workloads you actually run — what could you reasonably reach for in the next twelve months?
Sometimes the answer is “very little, until your cornerstone vendor sanctions a version of this capability.” That is a real answer. It is also actionable in a different way. It tells the buyer to lean on the cornerstone vendor harder, to participate in the design feedback loop, to get the sanctioning timeline accelerated. The signal becomes a procurement and partnership signal, not a tooling decision.
Sometimes the answer is “open source might be the only path through, because the SaaS vendors will never get past your data residency rules, and the cornerstone vendor will not move fast enough.” That is a different real answer. It is also less risky than it sounds, because privately-hosted open source under disciplined operation can pass governance gates that a third-party cloud service never will.
Sometimes the answer is “the path is technically open, you just have not staffed the discipline yet.” That answer is the one nobody likes hearing, because the gap is internal, not external. It is also the most actionable, because it does not depend on a vendor or a regulator — it depends on a hiring decision and a roadmap commitment.
Three different answers. None of them visible if your framing only has two buckets.
What this means for the ICP question
Adding the third bucket has changed how I think about who Naftiko is for.
The temptation, especially early, is to chase the largest most regulated names — the logos that look impressive in a deck. I keep getting pulled away from that temptation when I do the third-bucket exercise honestly. A walled-garden enterprise that has not yet been sanctioned to do anything with us is not a customer. They are a future customer, contingent on a regulator or a cornerstone vendor moving first. That is a relationship worth maintaining. It is not a relationship worth pricing a quarter against.
The sweet spot is a different shape. It is the company that has enough scale to have a real integration problem, enough autonomy to make architectural decisions on its own timeline, enough discipline to operate open-source infrastructure responsibly, and enough exposure to the AI shift to feel the pressure of acting now rather than later.
Mid-market and large-enterprise companies outside the most heavily regulated industries cluster heavily here. So do the regulated companies whose cornerstone vendors are already in alignment with the open-source path. So do the digitally native organizations whose stack has been API-first since day one and whose governance can absorb a new capability layer without a multi-quarter procurement cycle.
That is the cohort where the two-bucket framing works, and where the conversation can move from signal to action inside one engagement. The third bucket exists for everyone else, and the right thing to tell that audience is the truth — here is what is even possible from where you stand, and here is what would have to move upstream of you for that envelope to widen.
The honest framing for buyers
If you are sitting on the buyer side of this conversation, the third bucket is your friend, not a downgrade.
It tells you whether your current state is the result of choices or constraints. It tells you which constraints are external — and where to push them. It tells you which constraints are internal — and which staffing, discipline, or process decisions would unlock movement. It tells you whether your cornerstone vendors are accelerators or anchors, and what a healthy version of either of those relationships should look like next quarter.
A signal framework that only ranks you on what you use and do not use is not enough for that conversation. A signal framework that puts a third bucket alongside it — what is reachable from your current envelope — is.
That is the framing I keep landing on when I sit across the table from a real buyer. Not “what are you using and what are you missing.” Not “what should you adopt next.” But what is actually within your reach today, what could become reachable with one specific upstream move, and what is realistically out of reach until something larger shifts.
Two buckets describe the present. Three buckets describe the present and the path. The path is what most enterprises actually need help finding.
