> I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security Perhaps the

> I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security Perhaps the best place to start is with the lack of risk aversion that most startup founders have. In my experience, your are more likely to sell a startup type on the business opportunity that being secure creates as opposed to risk. You are likely dealing with a person who cannand will go all in on pair of threes.