What's way more important than being smart about security is consistently not being dumb about it. Knowing about the most important dangers (OWASP Top 10) and

What's way more important than being smart about security is consistently not being dumb about it. Knowing about the most important dangers (OWASP Top 10) and avoiding them while picking up some best practices on the go yields much better results than being completely oblivious on the topic and then try to "pay back" half a decade of neglected security that has not been baked into the architecture by then. In the end though, later is usually preferable to earlier. I know less companies being killed by absolute lack of security (heck, even Equifax is still around) than companies having failed to achieve product-market fit because they focused too much on something else than their core mission. Opportunity cost is real. For a pragmatic guide on striking a good balance, I've found this one helpful: https://www.sqreen.com/checklists/saas-cto-security-checklist https://www.sqreen.com/checklists/saas-cto-security-checklis...