Wouldn't even take that long. I could throw together a flashy "antivirus" that looks really good and does nothing more than a simple file signature lookup in a month. I could probably also get some sales of it to small companies that don't know any better. But to be ground breaking in the cyber security world and build something that is the foundation of a new company is just not feasible in 3 years without massive help from VCs, which isn't going to happen without a PoC or connections.