2026-08-28

Good enough security process

I don’t pretend I can tell each and every company what their security setup should look like but if you are a company involved in creating software and don’t have a concrete plan and process of how to deal with cyber security, you are in the right place.

Where I assume you are now

Your developers probably do think a lot about the security aspects of specific tasks they are doing. Maybe they even dive too deep into a single aspect that is not yet relevant to a company your size. My favorite example is obsessing about downtime risks of your suppliers. If you are only down as often as AWS your business will be fine.

This is the classic world-class trap. Because your people are ambitious and conscientious, they see what could still be done in the task they are on and might expend more resources than warranted.

goodenough > world class
Because most businesses are not world class
Is yours? And if yes at what?

Your security spend vs. what it costs to be secure
  • Cost to reach each level
  • Spend toward target
  • Short of target
  • Beyond target
Relative cost, log scale 1× 10× 100× good enough bare minimum world class Left uncovered This is the one they will find Built world-class More effort than the risk warrants Not considered Did not fit anyone’s job description accountspiibackupsnetworksecretsredundancypen testingdependenciesdevelopers Your threat surface Width = proportional to the maximum impact

What you are probably missing

Security is a game of strong ties, like staying healthy. No point in running 4 times a week while having a 2 packs a day smoking habit.

Cyber security is much the same. All it takes is one gaping hole and the attackers are in, no matter how elaborate your defenses somewhere else are.

What I see most often and have done myself is that certain tasks just don’t come up naturally in anyone’s job and so they are not done at all. Or the even more insidious variant - somebody like the CTO has made a perfectly reasonable decision in month 5 of the company’s lifetime and it was never reconsidered until year 3 where it was no longer appropriate at all.

So what to do instead

Actually it is really easy. Enumerate all security threats your business faces. Rank them by how bad an incident would roughly be minus the cost of the specific action to prevent it and then do a goodenough job on each one so you can move on to the next.

That would like like this if you made it through everything.

Your security spend vs. what it costs to be secure
  • Cost to reach each level
  • Spend toward target
  • Short of target
  • Beyond target
Relative cost, log scale 1× 10× 100× good enough bare minimum world class Still too good Better to overdeliver than underdeliver Close enough In reality we can’t measure this anyways accountspiibackupsnetworksecretsredundancypen testingdependenciesdevelopers Your threat surface Width = proportional to the maximum impact

When you are done, start again, because security is never over. It’s like brushing your teeth.