Eighty-five percent of SBIR Phase II winners never make it to meaningful Phase III commercial revenue.
Not because the technology fails. Not because the agency stops caring. Because the firms who win Phase II are structurally bad at the thing Phase III requires: turning a custom-funded prototype into a repeatable product.
SBIR is a services contract pretending to be an R&D grant. The agency pays you to build something specific for them. The "commercialization plan" you wrote in your proposal was a requirement, not a real plan. When Phase II ends and the agency says "great work, now go sell this commercially" — you're a services firm with a bespoke prototype and no product infrastructure.
Productizing an SBIR isn't impossible. It's just mechanically different from productizing ordinary delivery IP, and most founders don't know the difference until they've already made the expensive mistakes.
Here's the realistic framework. It's drawn from HARBOR's Harvest + Architect phases, stress-tested against the handful of SBIR firms we've worked with, and specifically adapted to the constraints you're actually working under: a custom-built prototype, a single agency customer, limited or no commercial pricing data, and a data-rights clock.
The three questions that determine Phase III viability
The first thing to understand is that not every SBIR is productizable. Some Phase II deliverables are genuinely bespoke — the agency wanted a thing exactly for them, there's no market for it outside that use case, and your "commercialization plan" was fiction from the start.
Before you spend another dollar trying to productize, answer three questions honestly:
Question 1: Is the core problem you solved specific to one agency, or common across many?
If your Phase II built a threat detection platform for a very specific Army sensor configuration, and no other agency uses that sensor, you don't have a product — you have a custom project. Move on.
If your Phase II built a data pipeline that processes sensor telemetry into threat candidates, and the underlying pattern (sensor → ML → threat queue) applies to DHS, intel community, maritime, healthcare imaging, and industrial IoT, you have a product. Keep going.
The test: can you name three non-DoD (or non-original-agency) use cases where your core technology would solve a real problem?
If no: productizing is probably not the path. Pursue a follow-on Phase II or Phase III with your existing agency.
Question 2: Do you have unencumbered data rights to commercialize?
Phase II data rights are complicated. Typically the government gets "government purpose rights" for 5 years, after which rights transfer back to you. But if you accepted any optional terms — particularly SBIR Commercialization Readiness funding — you may have granted the government extended rights. And if your prototype incorporates government-furnished information (GFI) or derivatives of classified data, you may not be able to commercialize externally at all.
Before you spend a dollar on Phase III commercialization, have counsel review your Phase II contract. We've seen firms waste 12 months building commercial versions of products they couldn't legally sell outside the originating agency. The fix is always easier if you find out now.
Question 3: Can your existing Phase II work become the 70% "core" of a product, or does most of it need to be rewritten?
One of the foundational ideas in HARBOR is the 70/30 Rule — a product's core is 70% of functionality and is never customized; the other 30% is customer-specific configuration and integration. Violating this boundary collapses product economics.
Now apply that to your Phase II prototype. Look at the codebase honestly:
- Is 70% of the code generalizable (e.g., the ML pipeline, the data ingestion, the visualization layer)?
- Or is 70% of the code agency-specific (hardcoded sensor configs, agency-specific data schemas, customer-specific UI flows)?
If it's the first, you have a productizable core. You'll rewrite maybe 10-20% to generalize.
If it's the second, you have a custom project. Commercializing it means rewriting the bulk of it — and at that point, starting over with a clean-sheet product is often faster.
The four production paths
If you clear all three gates above, you have four realistic commercialization paths. Each suits a different firm profile.
Path 1: Sell Phase III directly to your Phase II customer
The simplest and most common Phase III path. Your agency customer is happy with the Phase II deliverable and extends you a Phase III sole-source contract to productize and deploy at scale. They keep buying, you keep building, everyone's happy.
When it works: your agency customer has internal budget authority and an expansion pathway. They like what they bought and want to grow it.
When it doesn't: budget cycles shift, the PM moves, or the program of record changes. You become a single-customer services firm in disguise. This is actually how ~60% of successful-on-paper Phase IIIs end up — technically Phase III but economically services.
Path 2: Sell the same product to additional federal agencies
Take your Phase II tech, productize it (with a proper product CLIN structure, not a services CLIN), and sell it to 3-10 agencies. Classic federal SaaS play.
When it works: cross-agency demand exists, your vehicle access supports multi-agency sales (GSA MAS with software SINs, an IDIQ that opens federal-wide), and you have a sponsor at agency #2 ready to commit before you build.
When it doesn't: no vehicle, no sponsor, or the product is too niche for cross-agency expansion.
Path 3: Sell the dual-use version commercially + keep federal
Many SBIRs have a commercial analog. Sensor analytics? Every industrial IoT company wants this. Data pipelines? Every commercial SaaS company wants this. You build the federal version (authorized, FedRAMP-compliant) and a commercial version (cheaper, faster-moving, higher margin).
When it works: the commercial market is real and willing to pay, and your team can maintain two parallel product lines.
When it doesn't: commercial market is soft, or the cost of maintaining two lines exceeds what either line can support.
Path 4: License or exit to a strategic acquirer
Some SBIRs are better monetized through strategic sale than through building a product business. If Anduril, Palantir, Shield AI, or a commercial SaaS player would pay $5M–$20M for your IP + team, that's often a better outcome than the 3-4 year slog of building a product company.
When it works: your IP is genuinely unique, your team is core to the tech, and there's an active acquirer market in your domain.
When it doesn't: commodity tech, generic team, or no active acquirer interest.
The FedRAMP decision for Phase III
If your Phase III path is Path 2 (cross-agency federal SaaS), you're going to face a FedRAMP decision early. The rule we recommend:
- If your product handles only low-impact data and has minimal system interconnections: pursue FedRAMP LI-SaaS. $100K–$300K initial, 3-6 month timeline. Achievable with your Phase III budget.
- If you handle CUI, PII at scale, or need to integrate with Moderate-baseline customer systems: you need FedRAMP Moderate. $500K–$1.5M initial, 6-12 month timeline. This typically requires a Phase III award + additional seed capital.
- If your customers demand DoD IL4+ or FedRAMP High: budget $1.5M–$3M+, 12-18 month timeline, and make sure the customer commitment justifies it.
The mistake we see Phase III firms make most often: they default to FedRAMP Moderate when LI-SaaS would work. The 5x control reduction is real and materially changes the economics for a small firm.
The vehicle problem nobody talks about
Here's the biggest hidden constraint: Phase III doesn't solve your vehicle access problem. A Phase III award lets you sell more of what you built to the agency that funded you. It doesn't give you cross-agency selling rights.
If Path 2 is your plan (multi-agency federal SaaS), you need:
- GSA MAS with software/SaaS SINs — typical 18-24 month acquisition, start now
- Or a GWAC/IDIQ with product CLINs — if you can find one with on-ramp windows
- Or a channel partner arrangement — Second Front Systems, Palantir, Shield AI, or similar that lets you ride on their vehicle
Without one of these, you have a product but no way to sell it at scale. This is the most common Phase III failure mode we see — the firm builds a great product, authorizes it, and can't sell it because the vehicle path isn't real.
The 18-month Phase III commercialization plan
For a firm clearing all three gates above and committed to Path 2, here's the realistic 18-month plan:
Months 1-3: Architect the product. Use the HARBOR Architect tools (Hill Selection, Product Commitment, Resource Allocation). Pick one market hill. Write a 20-page product spec. Commit the team.
Months 3-6: Start FedRAMP LI-SaaS + pursue vehicle access. Both in parallel. Budget $250K-$400K for this phase.
Months 6-9: Build + pre-sell. Ship MVP internally. Get written LOIs from 3-5 potential customers beyond the original Phase II agency.
Months 9-12: LI-SaaS authorization in review; MVP to first customer. First commercial customer at 60-70% feature parity. Budget for iteration.
Months 12-15: Authorization complete; expand to 3-5 customers. Federal SaaS revenue starts flowing.
Months 15-18: Scale + HARBOR Replicate. Standardize pricing, CLIN structure, sales motion. Ready for Phase III extension or follow-on funding.
Total capital required: $500K-$1.5M depending on authorization tier and team size. Most of this should come from Phase III revenue + potentially $200K-$500K of outside seed capital if needed.
How HARBOR Agent + Signal help Phase III firms
For SBIR-holding firms considering Phase III, we recommend starting with the free HARBOR Signal diagnostic — it specifically scores you on the three gates above (agency specificity, data rights, 70/30 generalizability) plus the broader readiness dimensions.
From there, the HARBOR platform walks you through the full Harvest → Architect → Risk-Proof → Build → Operate → Replicate methodology. The Economics Calculator models your FedRAMP costs + revenue ramp. The Vehicle Selection tool maps the acquisition vehicles appropriate for your size + product type.
If you're a Phase II winner thinking about Phase III: you're not alone. Most firms in your position struggle with the same structural problems. The methodology is in our books, the tooling is on the platform, and the Signal diagnostic is free.
The 85% failure rate in SBIR commercialization isn't inevitable. It's what happens when firms try to productize without a playbook.
We wrote the playbook.
Related: How much does FedRAMP actually cost? · The valuation gap · FedRAMP LI-SaaS explained
About HARBOR: HARBOR is a book-codified methodology + platform for federal services firms transforming into product companies. Run the free diagnostic at harbor.build/signal.