Hi my name is Koby 👋 and for more than a decade I’ve been helping startups invest money into marketing, sales, product, and yes, cybersecurity, to help them grow their revenue.

My official title in my last two roles has been “head of growth” which is just a nice way of saying I do whatever is necessary to help a startup grow.

I don’t normally start posts about myself but I wanted to share just a little bit for credibility here, because I’m very very good at something that I think will help a lot of you - I’m S-tier at getting executives to invest money into valuable initiatives.

I think this is something that most humans responsible for the security of their organization really struggle with.

Often cybersecurity & compliance is seen as an afterthought.

“Do we really need to do this?”

“Is there actually a value to this penetration test?”

“What’s the easiest way for us to get this done?”

Cybersecurity departments at startups & large organizations are notoriously one of the most under-resourced teams. CISO’s begging for headcount, CFO’s trying to squeeze “efficiency” by citing miserable industry benchmarks.

To make matters worse, cybersecurity can seem to be an infinite money pit, where even if you DO throw millions of dollars at the problem of trying to become secure, there is STILL a chance that you will get compromised.

If you’re responsible for the data security of your organization, this post is to help you get the resources you need to be successful.

The most important rule of winning internal resources for cybersecurity is this: there are only three reasons startups invest in cybersecurity, they’ve been compromised before, it’s blocking a deal, or they are required to by law.

Recovering from a data breach: They’ve been compromised before.

I like to start with the “they’ve been compromised before” because this is the source of the business need for investing into cybersecurity. Even legal regulations are simply based on the key concept that “companies are getting hacked”.

There’s a rule called Murphy’s Law that states “anything that can go wrong, will go wrong.”

If you work in cybersecurity, this is probably one of the most important principles for you to understand. It pays for your salary, it’s what will get you promoted (or fired), this is the driving force behind the business need of cybersecurity.

Imagine for a moment if 5 people go to a work event and get really drunk. There’s a non-zero chance that one of them does something stupid and needs to get fired. But also there’s a really strong chance, probably 80-95%, that nothing bad is going to happen.

This is fine.

Now imagine that there’s 50 people who go to a work event and get really drunk. Much bigger chance something bad happens.

Now imagine 500. Now imagine 5,000. Now imagine 50,000.

The more surface area you have, what used to be a “small team grabbing drinks” turns into “something bad will absolutely happen.”

Cybersecurity is like this.

When you are small, your surface area is much smaller. Sure you’re still a target, but you’re flying under the radar, there’s a much smaller chance you are going to be compromised.

But as you scale?

You introduce more humans, your product surface area increases, you launch multiple products, you have old legacy code nobody actually understands anymore, you enter more geographies. You also launch or Product Hunt, Hackernews, you get PR on Forbes. You raise more money, you make more money, you hold more sensitive data.

Your likelihood of having a data leak or becoming compromised scales exponentially as the organization grows, your value as a target grows right alongside your attack surface area.

And eventually … anything bad that can happen, does happen.

This is why large organizations are basically forced to invest in cybersecurity. At a certain scale and surface area it’s basically a guarantee to become compromised. You are almost promised to become compromised if you do not invest in a certain level of security.

Some organizations absolutely begin to implement strong controls long before this happens, but also many don’t.

I’m just going to be really transparent, trying to convince a CEO or a Chief Product Officer to invest in cybersecurity before they’ve been hacked and personally feel the pain is going to be really really hard.

You can try to show them personal stories of similar companies, industry stats, bring in consultants to give an outside view - but it’s going to be hard.

The secret cheat code? Help them see security as a way to increase revenue, not simply prevent threats.

Security gaps costing millions: It’s blocking a deal.

Because large startups are basically forced under a near inevitability of being compromised, to start investing in cybersecurity, they will begin to require that anyone who provides services or integrations to them are ALSO secure.

This is your secret weapon if you are in an early stage company who has not yet experienced the pain of a security breach.

A strong security posture doesn’t just help you prevent your organization from being compromised, it can be a critical tool and a strong value prop to your marketing & sales team.

The dirty secret of a SOC 2 report is that it’s for your marketers and sales reps, not necessarily your security team.

Your security team knows whether or not you are secure. The SOC 2 report is so other people know you are secure.

When your organization is selling into a company that cares about security, actually becoming secure can help you unlock a LOT more business. Maybe it’s only 5% of your business. But maybe 50% or more of your business has the potential of coming from enterprise organizations.

A strong security posture helps you not only unblock these deals, but to maximize your revenue.

Even 5% on a business that’s doing $100M a year, is a $5M a year unlock. If half the business is enterprise? Then that’s $50M a year that’s being assisted and empowered through your security efforts.

A strong security posture is not only going to be a binary requirement for closing these deals, it’s going to help you get through the process faster, it’s going to help you increase the speed of your buying cycles.

You know what sales reps, CEO’s, and CFO’s all hate? Having a $1,000,000 deal held up for 3-4 weeks because the CISO is unhappy with one of your security controls.

Here’s a few tricks to talk about the value of your security as it relates to revenue:

1. Go into Hubspot or Salesforce, pull the account information, and show the historic information of how many deals have been assisted by your security posture.

2. Estimate the market size that can be unblocked by obtaining a strong security posture. Show confidence intervals, “If we close 5 deals worth $100,000 each, that’s $500k. If we close 20 deals worth $1,000,000 each that’s $20M. In each case, our security expense is x% of this potential revenue.”

3. Pull in quotes & feedback from the sales reps. How are they being impacted by CISO’s and IT Managers asking about security? How often does this come up? How long do deals get stuck in security review?

If your business is selling into organizations that care about security, you should be able to turn your security posture not just into an operating cost that we want to keep as small as possible, but a value prop that people will want to invest into, because it will help drive more revenue and speed up sales cycles.

Avoiding fines: It’s required by law.

The final reason that people invest into cybersecurity is that it’s being required by law.

If this is you, I want to give a sincere plea to please take this seriously.

I get how hard it is to create a startup, to simply build something that somebody wants, to get to ramen profitability. Needing to comply with regulations like HIPAA or GDPR can seem like a colossal waste of time that’s just getting in your way of driving revenue.

If you’re being required by law to implement cybersecurity, you need to realize that this is only happening because you are handling some of the most sensitive data on the planet that governments have felt the need to regulate.

So take a deep breath, and meditate for a moment on what it really means to protect your users privacy. That you are being entrusted with something sacred, your users trust.

Don’t take this simply as a box that needs to be checked, and a list of bare minimum requirements we need to dance through, but a warning sign.

You are holding sensitive data. People are very likely going to try and get this data from you. You need to protect it.

… And there will be consequences if you do not protect.

HIPAA violations have a four tiered system for fines & penalties:

• Tier 1: Lack of knowledge: The lowest tier, with a minimum penalty of $127 and a maximum penalty of $30,487.

• Tier 2: Reasonable cause and not willful neglect: A minimum penalty of $1,280 and a maximum penalty of $60,973.

• Tier 3: Willful neglect, corrected within 30 days: A minimum penalty of $12,794 and a maximum penalty of $60,973.

• Tier 4: Willful neglect, not timely corrected: A minimum penalty of $50,000 and a maximum penalty of $1,500,000.

On top of all of the consequences of simply having a data breach or becoming compromised, depending on the regulation type there are additional imposed penalties for becoming compromised.

While these increase the negatives and risks of a data leak, it’s all still important to remember that if you’re in a regulated industry that likely means that the people you are selling into are going to care about security even more - and that’s an opportunity to drive more revenue.

Don’t just become HIPAA compliant.

Use it to differentiate yourself. Get a 3rd party attestation, implement strong controls, talk about it in your messaging.

The most boring brand advice about healthcare is “blue is the color of trust”. It’s boring but there’s wisdom in this. In healthcare you should be baking trust into even the colors you display to your users.

If you’re going to that level of extremes to convince potential users to use you, then going beyond simply checking boxes to actually building a strong real-world security posture is going to help you unlock more revenue.

TLDR on how to get CEO’s to spend money on cybersecurity & compliance

There’s a great book called “all marketers are liars” and the moral of the story is that you can never get people to believe something new. You can only tell them what they already believe.

I spend most of my days talking to CEO’s & founders about spending money on cybersecurity, SOC 2, ISO 27001, HIPAA, GDPR, and more.

I’ll tell you a secret - I’ve never been able to get someone to change their mind. If they see security as a way to prevent threats, excellent. I love those conversations.

But if they are focused on “where do I invest my time, effort, and money to grow asap” which in fairness is the #1 priority of most CEO’s, then positioning cybersecurity as a tool to help maximize that revenue has been one of the most impactful ways to talk about investing in security.

If you’re responsible for the security or compliance of your organization, I hope something in here was useful. 🙏