flâneur

Early Security for Startups

devd.me · 3,405 words · saved by 1 readers

I once read blogging advice: if someone asks you something, write it as a blog post and soon you will have a blog. One advice I am often asked is “I am a new startup; how should I approach security?” Here goes my attempt, based on my experience working at and advising hypergrowth companies. Please send me your thoughts and feedback! This is advice for early-stage startups without security teams (the post ends with advice on your first security hire!). It focuses on the basics for an early-stage startup. If you already have a security team, listen to the team! Most of my experience has been in product-led enterprise SaaS businesses. This guide is likely useful to such startups. If you are working on things like social network or a crypto product, your threat model and priorities are very different, and this guide is likely not correct for you. That said, it might still be useful! The guide also assumes that the founders and early members of the team already care about security. As an ex

I once read blogging advice: if someone asks you something, write it as a blog post and soon you will have a blog. One advice I am often asked is “I am a new startup; how should I approach security?” Here goes my attempt, based on my experience working at and advising hypergrowth companies. Please send me your thoughts and feedback! Who is this for? # This is advice for early-stage startups without security teams (the post ends with advice on your first security hire!). It focuses on the basics for an early-stage startup. If you already have a security team, listen to the team! Most of my expe

related reading