CYBERSECURITY TECHNOLOGY ADOPTION CYCLE AND ITS IMPLICATIONS FOR STARTUPS AND SECURITY TEAMS

Summary from the TLDR InfoSec newsletter

Security teams can be classified into three categories: mature and engineering-focused teams, mature but not engineering-focused teams, and less mature teams or organizations that lack resources. Mature and engineering-focused teams will look to build their own tools, become design partners with early stage startups, and only look to buy tooling once it becomes commodified. Mature but not engineering-focused teams will often buy tooling from early-stage startups. Less mature teams will primarily wait for larger companies to adopt new tooling and features to reduce the amount of products they pay for. Startups need to be aware of these trends as they are the inverse of typical strategies. Security teams need to consider this cycle when deciding to build vs buy tooling.