My perspective, having sold a company: security isn’t that important until you’re big. When you’re small you’re a small target, your resources are better spent

My perspective, having sold a company: security isn’t that important until you’re big. When you’re small you’re a small target, your resources are better spent on features and sales, and if you get hacked you can change your name and pretend you’re a new entity. I know this isn’t the ethical answer but it is the realpolitik answer. Invested maybe 50 dev-hours in security over 4 years.