I see that and I see a bad security posture, and the responsibility passed up chain and even harder to answer the same questions about oneleet. Will they secure your gsuite email I assume you’re using? Will they respond to phishing attacks at you? Will they prevent SMS 2FA? Will they get you into SSO? Is a password manager in place? Are y’all using personal laptops still? Segregated logins? Will they tell you not to share publicly as a VC-backed startup about who is doing your infrasec and by a pretty clear implication what your infra likely looks like?
How to not turn you into me hacked is a balance of the prod/infrasec (like the company you linked), and bread and butter enterprise sec, which only comes from in house. So, in house team, or at least a 1x hire, such that there is at least a more than vague indicator that someone in house there day to day knows how to do security, or it doesn’t matter from a vendor risk point of views.
The list of vendors that have passed audits with complaint environments and gotten hacked is very long.
How to not turn you into me hacked is a balance of the prod/infrasec (like the company you linked), and bread and butter enterprise sec, which only comes from in house. So, in house team, or at least a 1x hire, such that there is at least a more than vague indicator that someone in house there day to day knows how to do security, or it doesn’t matter from a vendor risk point of views.
The list of vendors that have passed audits with complaint environments and gotten hacked is very long.