In the first stage, the ‘product-market fit’, we zoom in on start-ups. These are smaller companies that are still defining their first product. If you were the CISO or security expert for these companies, what would you focus on?

You’ve just started, you’re enthusiastic and looking at your own product. And you want to market it as quickly as possible, but in a qualitative way. And sometimes cybersecurity is overlooked which, of course, isn’t ideal. Especially in times like these, when cybersecurity is a top priority for many stakeholders.

Even though resources are often limited, start-ups can still take the first steps. Everything depends on the market and the customers you have or want to target. But a good way to start is to do a penetration test once the product is developed. This gives you a good overview of the cybersecurity maturity level of your product and you can immediately detect and fix critical or early vulnerabilities.

Carrying out a requirements engineering process is essential, particularly in the first stage, to get a clear picture of what customers expect. Of course, it depends on the segment you want to target, but especially in security-sensitive market segments, such as banks or technology companies that may handle a lot of intellectual property, you have to deal with strict procurement processes. Although you’re in the early stages, that doesn’t mean you shouldn’t have an in-depth understanding of what those expectations will be going forward.

First of all, you must ensure that your infrastructure and devices are properly secured. These basic hygiene measures are an important first step. The endpoints must be properly secured to provide sufficient protection against malware and ransomware.

In terms of product security, this can include measures like penetration testing, especially in the case of products or services that require the customer to add specific data. And it can also relate to security architecture.

When an end customer asks you: “Tell me, what does your product do?” and “What does it look like?”, as a start-up you can immediately tell them what you think the security architecture should look like, inform them of the threat model and the type of threats you anticipate. It increases their trust, as they feel that you know what you’re doing and have at least thought about it, especially in the early stages.

If you don’t have a fully finished product yet, it doesn’t mean you can’t have a completed roadmap. So, even in the first phase of that initial sales call, you can show the IT security requirements that your company needs. This is necessary to gain the trust of your customers.