I suppose that depends on the priorities of your company and your customers and how well those two align. Entrepreneurs are typically risk takers so a company

I suppose that depends on the priorities of your company and your customers and how well those two align. Entrepreneurs are typically risk takers so a company needs a CSO/CFO and legal team that appreciate the value of risk ranking and mitigating risks based on priorities in a practical manor that finds a balance of security and low to moderate friction. The head of the development org should also have an appreciation for mitigating security risks as they are often born out of bugs so it isn't all just security theater if one is zapping application breaking bugs. The head of the security org should accept that not all security bugs will be squashed and should focus on risk ranking and prioritizing the most feasible and high impact bugs first while avoiding hypothetical scenarios unless the red-team / penetration teams can prove they are not hypothetical.