I've found that using a risk-based approach to security requires a mature organizational framework for handling risk. A mature risk management process keeps goo

I've found that using a risk-based approach to security requires a mature organizational framework for handling risk. A mature risk management process keeps good records of how risks are handled, what the estimated impact and likelihood are, will promote accountability, and will learn when risks are realized. An immature one, of the sort many companies have, may have difficulty with some or all of these steps. Often the immaturity is invisible until it's too late - an impact or likelihood is far higher than estimated (and thus your quantification was wildly off and you took your estimate too seriously), there's no organizational accountability (so nobody who makes serious mistakes has to learn from it), and so on. I don't know how many SaaS startups have mature risk management processes, but I know I've seen companies well beyond the startup stage that suffer from immature ones.