Related Posts
Anyone want to grab a drink tn?
Overheard on LinkedIn

How is John St these days for accounts?
Additional Posts in Cyber Security Bowl
Any tips or tricks for CSX certification?
Views on carbon black as a product?
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.




It’s not about the tools but how you used them. A lot of cloud tools for example overlap, so you need to understand where the gaps are and define controls to address them. Understanding your risk posture is far better than buying a bunch of expensive tools.
A small company also very likely doesn’t need all of those. You probably aren’t employing hundreds of developers to write millions and millions of lines of custom code; instead, your tech stack is mostly, or all entirely the shelf software, or even fully SaaS. In those cases you don’t even need to bother with your own DAST, SAST, etc. - you can likely rely on your providers attestation. And you don’t have access to source code anyway, so static analysis isn’t even an option.
Similarly, smaller companies tend to be homogenous Microsoft shops, and with an E5 license now, you really have a powerful full-capability security stack. This doesn’t fit every large enterprise environment because they have so much tech complexity, but for small companies it’s great.
Eval risk and technical talent. Buy what’s outside of their ROI for TCO and build/ free tools for lower risk areas of your threat models that teams can self maintain . More importantly figure out mechanism of coverage needed when you threat model at the org level