This is all very directionally correct, to play devil's advocate I think the concern many have with the recent crop of startups is that most seem to "look like" they solve a security problem so they can get acquired, rather than genuinely having a mission.
It's becoming very common to see 50-100 people teams with barely couple of million in ARR and being staffed 85%+ with operational and GTM roles.
"...are we getting more secure?" or "How secure are we?" is the wrong question to ask. In fact, it is a question that can not be answered because at the end of the day security is nothing more than a feeling! You can not touch it, you can not measure it, it's completely subjective!
The real question should be "How resilient are we?" This you can measure and quantify.
- How long will it take to breach our defenses?
- How fast can we detect an attack?
- How fast can we respond?
- How many attacks can we handle at the same time?
This is all very directionally correct, to play devil's advocate I think the concern many have with the recent crop of startups is that most seem to "look like" they solve a security problem so they can get acquired, rather than genuinely having a mission.
It's becoming very common to see 50-100 people teams with barely couple of million in ARR and being staffed 85%+ with operational and GTM roles.
"...are we getting more secure?" or "How secure are we?" is the wrong question to ask. In fact, it is a question that can not be answered because at the end of the day security is nothing more than a feeling! You can not touch it, you can not measure it, it's completely subjective!
The real question should be "How resilient are we?" This you can measure and quantify.
- How long will it take to breach our defenses?
- How fast can we detect an attack?
- How fast can we respond?
- How many attacks can we handle at the same time?
- How long can we hold?
etc.