The Stealth-Founder Watchlist: From First Signal to Timed Outreach

This is a weekly procedure for detecting that a specific named person is founding a company, before any company entity is searchable in a database. It is for early-stage investors, platform and talent partners, and angels who want to reach a founder while the window is still open. It gives you a vendor-neutral correlation-and-confirmation method with signal ordering, a confidence rule, false-positive filters, and a timing model, so you are not dependent on someone else's black-box feed.

Most sourcing guides start from a company: a round about to close, a spinout, an exited founder with a known track record. This one starts from a person who has not yet built the thing you would search for. The difference is everything. By the time an entity is legible - a domain, an incorporation filing, a funding announcement - the information is priced in and the founder's inbox is full. The edge lives in the weeks before that, and it is a person-level edge.

Why founding is a person-level signal, not a company one

A founder exists before the company does. The detectable evidence of company formation is a sequence of changes to a named individual's public footprint, not a record in an entity database. That is the whole premise: you monitor people, because that is where everything starts.

Signals surface in three tiers, and they do not arrive together. Employment and network signals come first - a departure, a quiet title change, someone starting to recruit. Footprint signals come later - a newly registered domain, an incorporation filing under a holding company, a private beta on an obscure subdomain. Footprint signals lag employment and network signals by weeks, because the founder usually leaves and starts pulling in people well before any paperwork exists.

That count matters because of what happens when you try to filter it. In Refolk's index, filtering the US Stealth-titled population down to Founder or CXO seniority returns zero. The placeholder Stealth title carries no parsed seniority, so a title parser cannot infer a role from it. The standard senior-plus-founder filter every sourcing team reaches for will delete your entire target set. This job breaks the usual sourcing instincts, and you have to know that going in.

Where the signals live and how far ahead they run

The signals split into three categories with distinct lead times, and the order is what makes the method work. Employment signals raise the initial possibility, network and hiring signals confirm a team is forming, and footprint signals verify the entity exists. Each category is early or late relative to a public round, and mixing that ordering up is the single most common way funds arrive late.

Public GitHub activity is one of the earliest build signals. One tracker reading public GitHub across 350-plus startup orgs claims a velocity or contributor spike shows 21 to 47 days before the round hits the press. Certificate Transparency logs are a live domain signal - newly issued certificates often reveal newly launched subdomains before anything else does, and over 2.5 billion certificates have been logged since 2013, so the coverage is deep. SEC Form D sits at the other end: it is required within 15 days after the first sale of securities, which is a lagging confirmation, not an early signal.

Read this table as a warning about your own sources. If your process triggers on the bottom two rows, you are structurally behind by a month or more. The database that indexes funding lags the actual event by 30 to 90 days, so a fund waiting for a clean record to appear is competing against teams that reached the founder before the record existed.

The geography and title patterns you actually search

The surfaceable stealth population concentrates heavily by geography, which lets you weight a weekly sweep instead of boiling the ocean. In Refolk's index the US carries 350 Stealth-titled profiles against 42 in the UK, an 8.3 to 1 ratio, with the US set clustered in the San Francisco Bay Area. A weekly sweep can lead with the Bay Area and still cover most of the surfaceable population.

LinkedIn treats Stealth Startup as a real company with a page and job listings, so the naive move - searching the employees of Stealth Startup - is actually valid, and several name variations carry many employees. In Refolk's index the top US stealth employer strings are plainly Stealth, with 9, and Stealth Startup, with 8. That confirms the naive approach works and confirms the collision risk in the same breath: the same tokens pull in firms that are not startups at all.

The documented false positive to exclude is a finance-token collision. Stealth Management Group LLC is not a stealth startup, and neither are the asset-management firms that share the token. You handle this with an anchored, exact-match regex that excludes finance and management entities before anything reaches your candidate list.

The seniority filter you trust is the exact filter that erases the people you are hunting. </pull>

The confidence rule: category agreement, not signal count

High confidence comes from agreement across signal categories, not from counting signals inside one category. No public source publishes a fixed number, so treat this as a recommended standard: require at least two of the three categories to agree within a rolling 4 to 6 week window. Any single category in isolation produces too many false positives; combined, the categories yield high-confidence detection.

The categories do different jobs. Employment signals raise the possibility that something is happening. Network and hiring signals confirm a team is forming around the person. Footprint signals verify an entity now exists. No signal is reliable alone; the strongest reads come from signal agreement. The reason this beats any proprietary feed is that the discriminating logic is public. A benchmark of 1,000 companies found legacy platforms tracked about 75 percent of relevant signals while the best tracked 98 percent, so coverage genuinely varies - but the correlation logic itself is reproducible by hand, so you are never hostage to one vendor's index.

The most useful cell is the bottom-right: departed and recruiting. That combination is the discriminator between a stealth founder and any other senior departure. An employment signal alone only says someone left a job. The network signal adds that they are pulling people in to join them, which is pre-product evidence of company formation. The bottom-left cell, departed with no recruiting, is where sabbaticals and consulting gigs hide, and it is why you never promote on a departure alone.

This is exactly the kind of person-level correlation that is painful to run by hand across sources, because the signal is deliberately masked. Being able to ask for it in plain language removes the friction the three sweeps above create.

I built Refolk so that this kind of query - a departure, a masking title, a place, and an explicit exclusion - is a sentence rather than a chain of boolean filters and regex. It does not replace the confirmation work below, but it collapses the sweep-and-exclude stage into one ask.

The weekly procedure, start to finish

Run this as a weekly cadence. The setup happens once; the sweeps and correlation repeat every week. Roles and rough durations are noted so you can staff it against a real calendar.

Funds differ only in emphasis on where to start. Some lead with people-monitoring, watching individual operators first. Others start from surfaced companies and then check the people behind them. Both converge on the same correlation; lead with whichever matches your existing data, but do not skip the person-level layer, because that is where the earliest signal lives.

The acquired-founder calendar

Repeat and acquired founders give you a schedulable pipeline rather than a speculative one. When a founder sells, acquisition terms usually lock them in for a defined period, and the months approaching the end of that window are when many start planning the next company. Watching for earn-out expiry converts a past-acquisition roster into a dated list of likely builders.

The timing is well supported. Earn-out periods in middle-market deals typically run one to three years, most settling around two. Acquirers typically want key founders to stay at least two years and often three, using reverse vesting or holdbacks that retain 20 percent or more of consideration unless founders stay. More than half of founders leave within two years of closing, and only 8 percent stay by choice without a contractual lock-in. Put together, the reach-out window sits at acquisition date plus roughly 18 to 24 months.

Treat the window as a range, not a point. Not every acquisition has a public close date or a standard clock, and 41 percent of earn-outs pay zero, so some founders exit well before the nominal window and are already building. Confirm the acquisition date where you can, and if a founder's public footprint goes quiet inside the window, promote them rather than waiting for the calendar to catch up.

How this goes wrong

This method fails in specific, repeatable ways, and every one of them is a false positive or a timing error you can guard against. Treat this section as the load-bearing part of the standard.

• Title-string collision. Searching Stealth pulls asset managers and communities. The documented false positive is Stealth Management Group LLC. Guard: apply an anchored, exact-match regex and exclude finance and management entities.
• Seniority filters drop real founders. In Refolk's index the Founder or CXO filter on Stealth titles returns 0. The false positive is inverse - you delete exactly who you want. Guard: never gate the sweep on seniority; confirm it from the prior role instead.
• Sabbatical mistaken for founding. A departure with no new role can be a break or consulting. Guard: require a network or recruiting signal before promoting, because employment alone only says someone left a job.
• Footprint-first sourcing arrives late. Waiting for a domain or Form D means you are behind. By launch the founder has already picked a lead investor and made the first hires. Guard: trigger on employment plus network, not footprint.
• Single-signal false confidence. Any single category in isolation produces too many false positives. Guard: enforce two-category agreement inside the window.
• Stale-database drift. Indexed funding data lags 30 to 90 days. Guard: cross-verify against live Certificate Transparency and GitHub timestamps.
• Earn-out timing error. Not every acquisition has a public close date, and 41 percent of earn-outs pay zero, so some founders exit early. Guard: confirm the date and treat 18 to 24 months as a range.
• Community-page inflation. A Stealth AI Startup page with 196,658 followers is a community, not one company. Guard: verify individual profiles, never aggregate follower counts.

The through-line across these failures is timing discipline. The only durable edge is the pre-footprint window, and it is measured in weeks. Every failure mode above either introduces a false positive you should have filtered or pushes your trigger later than it needs to be. Both are fatal for a job whose entire value is acting first.

Before you call the list done

Run this check before anything moves to outreach. It catches the failures above at the point they still cost nothing.

Keeping the watchlist current

A stealth watchlist decays faster than almost any other sourcing artifact, because the entire target set is defined by transient states - just left, just started recruiting, not yet public. Re-run the two fast sweeps every week and treat the correlation and ranking as the weekly deliverable, not the roster. The roster is the slow layer; the ranked outreach list is the fast one.

Two maintenance habits keep it honest. First, expire candidates who cross into public legibility - once a company page, domain, and team are all visible, the window is closed and the name belongs in your normal pipeline, not this one. Second, re-verify footprint evidence against live sources on each pass, because a domain that looked stealth last month may now resolve to a launched product, and an indexed funding record may have finally caught up to an event you already acted on.

name | prior_employer | geo | employment_signal_date | network_signal_date | footprint_signal_date | acquired_flag | acquisition_date | reachout_trigger_date | agreement_count | owner | status

The status field should move a candidate through a fixed set: watch-only, confirmed (two categories), triggered (outreach owned), and closed (public or contacted). That single field turns the watchlist from a static document into a queue, and it makes the weekly review a matter of reading the transitions rather than re-reading every name. The names that matter are the ones that changed status since last week - a new network signal on a departure, or an acquired founder crossing into the 18-month window. Those are the ones to reach, before anyone else can.