Nobody Was Bothering to Attack You. That Just Got Cheap.
Being too small to attack was never security, it was scarcity of attacker attention. That scarcity is gone, and the fix is two days of work, not a security hire
Every interim CTO engagement I have walked into has handed me the same three findings in week one. A shared founder login that four people use. Live production keys pasted into a Slack channel, usually in a thread from eight months ago that nobody archived. And a contractor who finished their work last spring and still has access to everything.
Three for three. Not similar problems. The same three problems.
I used to describe this as normal startup mess, the kind of thing you clean up before a Series B diligence call. I was wrong about the timeline, and last week's news is why.
The thing that was protecting you was not security
A researcher pointed about 100 self-hosted agents at his own accounts and let them run for five hours. He wrote it up here. They broke into three accounts through software vulnerabilities, two more by brute-forcing passwords, and made sixteen separate social engineering attempts along the way. Five real compromises. Five hours. Models he ran himself, not a nation-state budget.
I have not run this experiment and I am not going to pretend I have. I do not need to. What the result describes is a change in economics, and economics is something I have watched break plenty of assumptions.
Here is the assumption it breaks. When a founder tells me "we're too small to be a target," what they are actually saying, correctly, is that a human attacker's afternoon is worth more than the contents of their Stripe account. That was true. Attacker attention was a scarce, expensive resource, and it went where the money was. Your five-person company was protected by the fact that nobody could be bothered.
That was never a security posture. It was a queue, and you were at the back of it.
Agents that cost almost nothing to run do not have a queue. They do not triage by company size, because triage costs more than just trying. They will spend four hours on your abandoned staging environment for the same reason a crawler indexes a page nobody visits: the marginal cost of doing it is close to zero and one hit in ten thousand pays for all of it.
Being unimportant stopped being a defense the moment attention became free.
Why founders specifically are in the blast radius
This is not a general "everyone should care about security" post. Non-technical founders with funding and no CTO are in an unusually bad spot, and it is structural, not a character flaw.
Your product is held together by convenience decisions that were all individually correct. The shared login exists because you and your ops lead both needed to check the dashboard at 11pm and setting up proper accounts was forty minutes you did not have. The keys are in Slack because the contractor needed them and Slack was where the contractor was. The contractor still has access because nobody's calendar has a reminder that says revoke Dmitri.
Every one of those was the right call in the moment. Together they are your entire attack surface.
And the part that actually matters: there is nobody on your team whose job includes noticing. Engineers notice broken builds. Marketers notice traffic drops. Nobody notices a dormant credential, because noticing dormant credentials is a job, and you have not hired for it. So the mess does not degrade visibly. It just sits there accumulating until something reads it.
What it actually costs to do this late
I scaled an engineering org from 4 to 31 people while running at 10M monthly active users. We retrofitted access discipline somewhere in the middle of that, and the cost of doing it then instead of at four engineers was not close.
At four engineers, defining who can touch production is a conversation and an afternoon of configuration. At thirty-one across multiple teams, it is an archaeology project. You are reconstructing who granted what to whom two years ago, chasing credentials embedded in services nobody currently owns, and negotiating with team leads who correctly point out that tightening permissions will slow their sprint. Every week you defer it, the work gets more expensive, because the thing you are cleaning up keeps growing.
The same curve applies to you at five people, just earlier on it. The difference is that the deadline used to be diligence, and now the deadline is whenever an agent gets around to you.
The actual week-one list
This is the part founders get wrong in the other direction. They hear "security" and picture a hire, a vendor, a SOC 2 project, a six-figure line item. Then they compare that to their runway and defer the whole thing.
What I am describing is roughly two days of somebody competent's time.
- Kill every shared login. Individual accounts, every person, no exceptions for the founders.
- Turn on two-factor everywhere, especially on the email account that can reset everything else. That one account is the master key to your company.
- Get production keys out of Slack and into a secrets manager, which is just a tool whose whole job is holding credentials so humans do not have to paste them anywhere.
- Write down who has access to what. A spreadsheet is fine. The point is that it exists.
- Add offboarding to whatever checklist you already use when a contractor rolls off, and run it against every contractor who has already rolled off.
- Set password requirements that survive brute-forcing, because two of those five compromises were just guessing.
None of that requires a security engineer. It requires someone senior enough to know where the credentials are buried and stubborn enough to finish. If you have a lead engineer, this is a two-day ticket. If you do not, this is a fraction of one fractional CTO sprint, and honestly it is the least interesting thing I do in those two weeks. It is also the thing that has been broken in every single engagement.
The line I would draw
Stop treating access hygiene as something you earn the right to care about once you have real customers. That framing made sense when attacker attention was expensive and rationed. It is now the cheapest thing in the pipeline.
You do not need to become secure. You need to stop being trivially cheap to break into, which is a much lower bar and two days of somebody's time.
If you are not sure which of those three findings you have, the answer is probably all of them. It has been every other time. Book thirty minutes and I will tell you where to look.