Personally, I hear the arguments about "how you do segmentation". My personal opinion is that that is a lazy cop-out that is only successful in an environment w

Personally, I hear the arguments about "how you do segmentation". My personal opinion is that that is a lazy cop-out that is only successful in an environment where no one is being held accountable for security or privacy violations. There are other ways to do segmentation, but they require actually understanding your customer and what they need in order to develop a value proposition. People will complain about how hard it is to implement. And that's a thing. We as an industry are to blame for that. Tools like Rails, Django, etc. should be setup to support SSO/SAML/OIDC/RBAC/Audit Logs/MFA by default--rather than the default always being 'start with a user table and shit password management'-- so that the cost of those implementations goes down, and so that the "best practices", such that they are, are implemented from the very beginning. Not at least supporting MFA and audit logs, at this point, should be considered an ethical lapse. Here's a list of things you could charge extra for: - White-glove support. - Higher quotas and usage. - Dedicated capacity. - Value-added services. - Dedicated/isolated instances. - Multi-instance configurations (Likely only a feature requested by actual enterprises or resellers) - On-prem installs. - Access to greater customizability. - Access to escrowed source code. - White-labeling or branding There are so many other things you can charge an enterprise extra for. Safety, security, and peace-of-mind in using your service shouldn't ever be a question.