← All articles

// strategy · guide

Security for Startups: What to Do First

Early-stage teams need security work proportionate to their data, product and customer commitments. The following starting points are not a complete programme or a measured reduction in risk. Adapt the order to your exposure and assign an owner to each action.

1. Turn on MFA everywhere

Prioritise email, cloud consoles, code repositories and privileged interfaces. Use phishing-resistant MFA where supported, protect recovery paths and test emergency access. Availability and cost depend on the provider; MFA does not prevent every account-compromise path.

2. Lock down your cloud

Review whether public storage is intentional, reduce excessive privilege and enable useful logging. Identify sensitive data, owners and reachable services rather than treating every public resource as a defect.

3. Get your dependencies under control

Inventory the dependencies and build components you ship. Review known vulnerabilities, reachability, update paths and provenance. Automated alerts help triage but do not establish that a component is safe or exploitable in your system.

4. Test before enterprise customers ask

Ask target buyers what assurance they require. A scoped penetration test or readiness review may support those needs, but neither guarantees procurement approval. Keep evidence and public promises aligned with actual operating controls.

5. Bring in advisory, not headcount

Decide whether an internal owner, time-bounded adviser or full-time hire best fits your risks and obligations. External advice can help sequence work; management retains accountability and must allocate people and budget to implement it.

Also establish tested backups, an incident contact route and a way to track exceptions and remediation. Revisit priorities as the product, data and customer requirements change.