Some thoughts as someone who's built software and product security programs in both cash-strapped and cash-rich organizations. I'm going to drastically oversimp

Some thoughts as someone who's built software and product security programs in both cash-strapped and cash-rich organizations. I'm going to drastically oversimplify, but bear with me: ▶ The ability to build an all-in-house or largely-in-house program is a luxury where largely every staffer, even staff-aug over time, can have the necessary institutional context to understand whether a threat is being realized. If you can do it comfortably and with a focus on automation, you probably should. To analogize: a castle has its own moat, its own hard walls, its own defense team, retractable entrances, traps, labrynth layout, etc. etc. ▶ A fully outsourced program doesn't have the necessary institutional context to catch edge cases or even a substantial number of common or uncommon threats and outcomes. Especially when the services used are multi-tenant, which is where a lot of the cost-savings come from for outsourced programs. So for an outsourced program to succeed, you'll probably still need a few hands to add that missing context or to work together with the service providers to help them automatically understand that context. To analogize: a house in a gated community shares the same security team and light barriers (fence, wall, whichever) as other houses, but that team might not be as well versed on what to look out for. And the house itself may have alarms, but none of this may be all that great at deterring a common smash-and-grab. --- Patreon had what, 1%-ish of their staff doing infosec? I'd venture that a lot of them performed functions such as automating appsec, automating integrations with service providers, etc., understanding privacy and security legislation and obligations, and served the role of contextualizing security between their internal product teams and external security service providers. Without a dedicated in-house team, no matter how small, I'd bet dollars that they'll be compromised again in short order. And I've advised people relying on Patreon to seek alternate services as a result.