About me

If you own or work at a small software company you have probably heard of cyber security or info sec. Most likely you have even taken various steps you felt necessary to keep your company safe. But most likely you have nothing that you would honestly describe as a process. And neither had I.

Doing my job

I had developed software professionally for a quarter century by now and never caused a security incident. Whenever I worked on a new thing I took security concerns into account and also kept my dependencies updated from time to time. I felt like a security conscious developer.

The time it stopped working

In early 2026 I took over a project that I was not involved with from the beginning with lots of preexisting code and services. While some of the original team were still on board it was not the people that set up the original infrastructure.

As it goes, pressing bugs had to be fixed and new features implemented on tight timelines. While again I reviewed new code and made sure we didn’t open up any security issues there I never went back to the drawing board and audited what was there.

Then in May the company the system belonged to got a report some data was leaked 1.

The price of ignorance

The security incident brought the cost of ignoring this field into sharp relief. While the company didn’t pay any ransom and nobody was fined, my direct client was on the hook for hundreds of hours of unpaid work, legal demands from the company the system was programmed for and vast reputational loss that eventually led to the loss of already anticipated revenue.

Curiosity born from chaos

After the dust had settled and I had time to analyze how it had come to that I asked myself the question.

If I did everything that seemed reasonable at the time, the same I did all my career. If every developer at that company just focussed on their immediate task and if at each company I consulted for the same general process was in place, then how many other companies basically rely on one unspoken directive?

Make no mistakes. Ever.

Because if nothing systematically corrects previous mistakes that is what you expect from your people. It doesn’t seem like a reasonable plan or process to keep your valuable data and reputation safe.

Suddenly security was on everybody’s mind and top of every priority list. Obviously it was too late.

Incentives

Because I also almost2 finished my masters in economics, I am always very curious of how the incentives are structured that underpin a certain behavior. So I began to ask myself how so many people can make the same myopic decisions. They must look right from their perspective at least at some point.

Some companies truly ignore everything about security and was probably a reasonable choice at one point in time. Others focus on being world-class at one particular thing like networking while not caring about much simpler things like password policies.

This is the origin of the goodenough security process an attempt to cut through the Gordian knot of when to care about security and how much exactly.