> Was it life or death for the startup to achieve "world class compliance"? Most likely. Nobody cares about security until they lose actual money because of i

> Was it life or death for the startup to achieve "world class compliance"? Most likely. Nobody cares about security until they lose actual money because of it. After that, your CISO now has the budget and importance defined by how much money the company got taken for.