Practical security guidance for growing companies: building security programs, passing customer security reviews, and making smart security decisions.https://iomergent.com/blog/en-ushttps://iomergent.com/blog/security-requirements-by-industry/https://blog.iomergent.com/security-requirements-by-industryThe question of when you need SOC 2 , ISO 27001, or other certifications isn’t universal. Your market tells you. And different markets have dramatically different expectations.Tue, 29 Sep 2026 13:00:00 GMTJon Rosehttps://iomergent.com/blog/what-to-do-when-security-team-cant-adapt/https://blog.iomergent.com/what-to-do-when-security-team-cant-adaptYour security team built a compliance program for a customer that no longer exists. Your business acquired two companies, pivoted its strategy, and dropped that major healthcare client who demanded High Trust certification. Now your security people are still running the same playbook, unable to explain why any of it matters to new leadership.Tue, 29 Sep 2026 00:00:00 GMTJon Rosehttps://iomergent.com/blog/compliance-is-not-security/https://blog.iomergent.com/compliance-is-not-securityA global service provider with approximately 1900 employees had everything they needed from the CISO to sell to enterprise customers: a SOC 2 report, ISO 27001, and all the accompanying compliance paperwork, the ability to pass audits consistently. Their security team could whip the tech teams into enough compliance to satisfy auditors every year.Tue, 22 Sep 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/what-security-decisions-should-ceo-make/https://blog.iomergent.com/what-security-decisions-should-ceo-makeA fractional or virtual CISO can build your security program, implement controls, and advise on technical decisions. But certain decisions require executive judgment that can’t be outsourced.Tue, 15 Sep 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/business-email-compromise-what-to-do/https://blog.iomergent.com/business-email-compromise-what-to-doThe call usually comes after something has already happened: bad actors got access to email tokens and started sending messages on behalf of employees, usually something related to finance like fake invoices to customers, wire transfer requests, or vendor payment redirections. CFOs and CEOs are often specifically targeted.Tue, 08 Sep 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/how-to-answer-security-questionnaires/https://blog.iomergent.com/how-to-answer-security-questionnairesYour engineer answered every question on the security questionnaire truthfully and thoroughly but the deal is stuck in the buyer’s third-party risk management process and your champion hasn’t returned emails since she received an earful from their security team.Tue, 01 Sep 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/how-to-hire-ciso-when-not-security-expert/https://blog.iomergent.com/how-to-hire-ciso-when-not-security-expertThe people hiring CISOs are usually not security experts.Tue, 18 Aug 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/security-requirements-for-ai-startups/https://blog.iomergent.com/security-requirements-for-ai-startupsThree years ago, you could argue that seed and series A companies had the luxury of finding product market fit and achieving early revenue traction first and securing later. Operate as lean as possible, build something people want and prove you can sell it without a founder in the room. Then come back to security once you have early growth to protect.Tue, 04 Aug 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/the-backup-question-nobody-wants-to-answer/https://blog.iomergent.com/the-backup-question-nobody-wants-to-answerMost companies we work with don’t have a data inventory.Tue, 28 Jul 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/startup-security-infrastructure/https://blog.iomergent.com/startup-security-infrastructure“We take security seriously.” If you’ve been selling into the enterprise, you’ve probably said this in a pitch deck. You might even believe it. But startup security infrastructure has matured to the point where those words carry zero weight with sophisticated buyers. They’ve heard them from every vendor, including the ones that got breached six months later.Tue, 21 Jul 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/soc2-vs-iso-27001-which-first/https://blog.iomergent.com/soc2-vs-iso-27001-which-firstA mid-market company gets told by an enterprise customer: you need ISO 27001 by the end of the year. They have no certifications, shaky documentation, and inconsistent security answers. The deal however depends on meeting this requirement.Tue, 14 Jul 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/using-ai-to-add-business-context-to-cloud-security/https://blog.iomergent.com/using-ai-to-add-business-context-to-cloud-securityWhen a new alert comes in, the first thing you want to know isn’t what the vulnerability is. You want to know whether you should care.Tue, 07 Jul 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/security-questionnaire-enterprise-sales/https://blog.iomergent.com/security-questionnaire-enterprise-salesThe security questionnaire is where enterprise deals go quiet. You built the product, nailed the demo, got the champion excited. Then procurement sends over 300 questions about your security posture, and the deal enters a black hole.Tue, 30 Jun 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/beyond-the-scanner-when-you-need-custom-tooling-for-cloud-security/https://blog.iomergent.com/beyond-the-scanner-when-you-need-custom-tooling-for-cloud-securityWe’re fans of cloud security tools over here: Prowler, Wiz, Orca, ScoutSuite. There are dozens of options, with new ones appearing regularly. They automate the heavy lifting of querying cloud environments and correlate findings across services.Tue, 16 Jun 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/aws-security-bill-cloud-cost/https://blog.iomergent.com/aws-security-bill-cloud-costCloud cost optimization isn’t usually a security conversation. It should be. The line items piling up on your AWS bill often point directly to forgotten infrastructure, and forgotten infrastructure is where breaches start.Tue, 09 Jun 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/how-much-should-startup-spend-on-security/https://blog.iomergent.com/how-much-should-startup-spend-on-securityNobody talks about what a security budget actually looks like. You hear general advice about investing in security, but the specific line items and realistic costs often stay vague.Tue, 02 Jun 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/the-hidden-roi-of-cloud-security-hygiene/https://blog.iomergent.com/the-hidden-roi-of-cloud-security-hygieneWe regularly find $5,000 to $10,000 per month in abandoned infrastructure during our first few weeks with a new client running our managed cloud security services .Tue, 26 May 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/engineering-shadow-it-risks/https://blog.iomergent.com/engineering-shadow-it-risksEngineering shadow IT risks are one of the most predictable blind spots in mid-market software companies. Not because anyone is acting in bad faith, but because the incentives point in the wrong direction. Your engineers solve problems by finding tools. Your security team finds out about those tools months later, if at all.Sat, 16 May 2026 19:53:59 GMTJon Rosehttps://iomergent.com/blog/should-first-security-hire-be-ciso-or-engineer/https://blog.iomergent.com/should-first-security-hire-be-ciso-or-engineerYou’ve decided to invest in security. Now you need to figure out who to hire first. A security leader to build the strategy? An engineer to do the actual work? Some hybrid role that tries to do both?Sat, 16 May 2026 19:53:59 GMTJon Rosehttps://iomergent.com/blog/how-to-build-security-program-from-scratch/https://blog.iomergent.com/how-to-build-security-program-from-scratchSomething triggered this conversation. Maybe customers are demanding you beef up your security program. Maybe you had a near miss or actual incident. Maybe your management team knows from experience that you’ve deferred this too long and it’s time to invest.Tue, 12 May 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/what-the-first-90-days-of-managed-cspm-look-like/https://blog.iomergent.com/what-the-first-90-days-of-managed-cspm-look-likeWhat happens when you engage a managed CSPM service ? Here’s what the first 90 days typically look like: from initial setup all the way through steady-state operations.Tue, 05 May 2026 13:00:00 GMTJon Rosehttps://iomergent.com/blog/soc2-engineering-implementation/https://blog.iomergent.com/soc2-engineering-implementationYour auditor helped scope the audit. Sales promised a Type II by Q3. And now engineering has to figure out SOC 2 engineering implementation for 47 controls without blowing the product roadmap. This is the pattern at every mid-market software company going through SOC 2 for the first time.Tue, 28 Apr 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/security-quick-wins-first-two-weeks/https://blog.iomergent.com/security-quick-wins-first-two-weeksWhen we engage with a new client as a Fractional CISO, we don't simply build a roadmap or deploy new tools. We start by evaluating and understanding the business and the computing environment that supports it, with or without a formal security assessment (almost always recommended but not always required). During that informal evaluation or formal security and risk assessment, we inevitably identify some number of high impact issues that require little time and little to zero cost to fix.Tue, 21 Apr 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/diy-vs-managed-cspm-an-honest-comparison/https://blog.iomergent.com/diy-vs.-managed-cspm-an-honest-comparisonShould you run CSPM tools yourself or bring in a managed service instead?Tue, 14 Apr 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/cicd-security-risks/https://blog.iomergent.com/cicd-security-risksAn autonomous bot spent a week in February attacking CI/CD pipelines across seven major open-source repositories. It compromised projects with 140,000+ stars, stole credentials with write access to production, and used those tokens to delete releases and push malicious artifacts to a marketplace. Nobody noticed for days.Tue, 07 Apr 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/cost-of-not-having-a-ciso/https://blog.iomergent.com/cost-of-not-having-a-cisoThe cost of not having security leadership isn't simply the risk of getting hacked. It's the daily tax on your organization.Tue, 31 Mar 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/the-business-context-problem-why-vulnerability-severity-scores-lie/https://blog.iomergent.com/the-business-context-problem-why-vulnerability-severity-scores-lieA critical vulnerability on an Alpine-based reverse proxy sitting behind three layers of network controls isn’t actually critical.Tue, 24 Mar 2026 16:00:00 GMTJon Rosehttps://iomergent.com/blog/cto-security-responsibilities/https://blog.iomergent.com/cto-security-responsibilitiesNobody adds "CISO" to the CTO job description. It just shows up one day.Sun, 08 Mar 2026 13:00:00 GMTJon Rosehttps://iomergent.com/blog/does-my-startup-need-a-ciso/https://blog.iomergent.com/does-my-startup-need-a-cisoThe triggering moment usually isn’t dramatic. It’s a sales deal grinding to a halt because your engineering team gave technically accurate but security-irrelevant answers on a questionnaire. Or it’s your CTO realizing they’re spending 15 hours a week on compliance tasks instead of building a product.Wed, 04 Mar 2026 13:00:00 GMTJon Rosehttps://iomergent.com/blog/alert-fatigue-is-a-design-choice-building-views-that-actually-help/https://blog.iomergent.com/alert-fatigue-is-a-design-choice-building-views-that-actually-helpThe default dashboard in your Cloud Security Posture Management (CSPM) tool is almost certainly wrong for you.Fri, 27 Feb 2026 17:35:57 GMTJon Rosehttps://iomergent.com/blog/introducing-iomergent-managed-cspm/https://blog.iomergent.com/introducing-iomergent-managed-cspmWhile running security programs for dozens of companies, we kept seeing the same pattern.Wed, 04 Feb 2026 16:41:23 GMTJon Rosehttps://iomergent.com/blog/the-vciso-dividend-why-fractional-security-leadership-is-gaining-momentum/https://blog.iomergent.com/the-vciso-dividend-why-fractional-security-leadership-is-gaining-momentumThe appeal of Fractional Security, and vCISO in particular, continues to broaden among small and medium enterprise customers. AI-native companies are retaining vCISOs before they start coding so they can train on proprietary data and achieve compliance benchmarks earlier than ever. Typical startups are getting serious about security and hiring vCISOs at earlier stages thanks to pervasive and increasingly rigorous third-party risk programs.Tue, 03 Feb 2026 15:58:11 GMTBrett Wilsonhttps://iomergent.com/blog/why-do-fractional-cisos-get-sideways/https://blog.iomergent.com/why-do-fractional-cisos-get-sidewaysIt’s almost a maxim around here: the more one of our clients needs an MSP (Managed Service Provider) for IT services, the worse the service fit and the security posture between the client and the MSP.Thu, 20 Nov 2025 16:43:38 GMTBrett Wilsonhttps://iomergent.com/blog/a-tale-of-two-security-programs/https://blog.iomergent.com/a-tale-of-two-security-programsIt was the best of times, it was the worst of times, it was the age of resilience, it was the age of weakness, it was the epoch rigorous protection, it was the epoch of unmitigated vulnerability, it was the season of vigilance, it was the season of disregard.Thu, 16 Oct 2025 13:39:35 GMTBrett Wilsonhttps://iomergent.com/blog/effective-ai-governance/https://blog.iomergent.com/effective-ai-governanceWe are willing to wager that, sometime in the last six months or in the six months to come, AI has or will become the top source of angst and opportunity for your business and your employees. Just look at the macro discussion: Record venture funding in AI startups Record valuations of AI startups Record time to revenue traction by AI startups Record investment in datacenters Reported AI trial failure rates between 60 and 95% Persistent underemployment in tech sectors Announcements of future layoffs due to AI efficiency gainsThu, 02 Oct 2025 13:43:54 GMTBrett Wilsonhttps://iomergent.com/blog/soc2-wont-close-the-deal/https://blog.iomergent.com/soc2-wont-close-the-dealYou’ve secured your SOC 2 report. You’ve passed the audit. Yet, your prospects keep asking questions about your security posture.Thu, 11 Sep 2025 14:29:02 GMTJon Rosehttps://iomergent.com/blog/security-isnt-a-department/https://blog.iomergent.com/security-isnt-a-departmentWhen growing companies decide to “get serious” about security, the instinct is to put someone in charge, give them a title, and make it official.Thu, 04 Sep 2025 18:57:26 GMTJon Rosehttps://iomergent.com/blog/the-real-hidden-costs-of-a-data-breach/https://blog.iomergent.com/the-real-hidden-costs-of-a-data-breachWhen most leaders think of data breaches, they think about the business disruption, client impact, and negative PR. Not to mention the actual unplanned financial cost of investigating, containing, and resolving the incident. From legal fees to fines and penalties, those numbers can add up quickly. We’ve never worked a declared incident where outside counsel was pulled in for less than $35K, and that’s without declaring a data breach. But short of a declared breach, those third party costs typically aren’t the ones that sting the most.Mon, 25 Aug 2025 15:37:49 GMTJon Rosehttps://iomergent.com/blog/policies-without-culture-are-just-pdfs/https://blog.iomergent.com/policies-without-culture-are-just-pdfsYou can’t “compliance” your way out of culture problems.Tue, 12 Aug 2025 15:15:48 GMTJon Rosehttps://iomergent.com/blog/when-hiring-a-full-time-ciso-is-too-much/https://blog.iomergent.com/when-hiring-a-full-time-ciso-is-too-muchFor many mid-to-late-stage growth companies, the first signs that “it’s time to get serious about security” feel urgent.Wed, 30 Jul 2025 15:53:34 GMTJon Rosehttps://iomergent.com/blog/hiring-a-ciso-wont-magically-fix-security-build-the-program-first/https://blog.iomergent.com/hiring-a-ciso-wont-magically-fix-security.-build-the-program-firstA CISO without a security program is like a pilot without a plane. Many organizations under pressure to improve cybersecurity hire their first CISO and expect instant results. The reality is that simply appointing an experienced security leader, without first developing a solid understanding of the company’s security related objectives, cyber risks and tolerances, and at least a foundational consensus on how to proceed, rarely solves the problem. And in fact, it can make the problem worse.Mon, 21 Jul 2025 14:10:33 GMTJon Rosehttps://iomergent.com/blog/here-are-the-4-most-thought-provoking-cyber-security-questions-the-national-association-of-corporate-directors-nacd-wants-your-board-to-ask-you/https://blog.iomergent.com/here-are-the-4-most-thought-provoking-cyber-security-questions-the-national-association-of-corporate-directors-nacd-wants-your-board-to-ask-youWe frequently ask these questions to executive teams to gauge the maturity of the cybersecurity program.Mon, 14 Jul 2025 12:30:00 GMTJon Rosehttps://iomergent.com/blog/we-use-that/https://blog.iomergent.com/we-use-thatGetting Your Arms Around Digital Supply Chain Security Risk In the case of third-party software libraries that your team builds into your SaaS offering, IoT or consumer electronics product, you need to have visibility and internal processes to analyze and manage related risks. The bottom line is that every company uses third-party software and while you don’t have to conduct a code review on everything, you do have to know the risks, in order to prioritize and manage them.Mon, 30 Jun 2025 12:45:00 GMTJon Rosehttps://iomergent.com/blog/the-vciso-dividend/https://blog.iomergent.com/the-vciso-dividendHow Fractional Security Executive Retainers Make Dollars and “Sense” Most executive leadership teams today are uncomfortably aware of the need for a strong information security posture, but not all are able to ensure it. That might be because: they are focused on their company goals, such as growing the business their risks are not formally defined, or they simply do not have the time, budget, or expertise for information security.Sun, 22 Jun 2025 08:00:00 GMTJon Rosehttps://iomergent.com/blog/it-takes-12-24-months-to-build-a-robust-security-program/https://blog.iomergent.com/it-takes-12-24-months-to-build-a-robust-security-programIt takes 12–24 months to build a robust security programThu, 12 Jun 2025 04:15:00 GMTJon Rosehttps://iomergent.com/blog/why-do-software-engineers-ignore-security-issues/https://blog.iomergent.com/why-do-software-engineers-ignore-security-issuesWhy is it, even in innovative companies, that development teams tend to ignore information security issues? Engineers and technical leaders don’t want to build insecure applications, platforms, and environments. Yet, in helping companies with their application security and DevSecOps, we usually find significant security backlogs. Let’s take it as a given that building secure applications requires expertise and investment and pose the question: Why is it, even in innovative companies, that development teams tend to ignore information security issues ?Thu, 01 May 2025 04:15:00 GMTJon Rosehttps://iomergent.com/blog/building-a-strong-security-program-using-the-nist-cybersecurity-framework/https://blog.iomergent.com/building-a-strong-security-program-using-the-nist-cybersecurity-frameworkHow to Create Customer Trust and Win New BusinessWed, 30 Apr 2025 10:00:00 GMTJon Rosehttps://iomergent.com/blog/accelerate-growth-with-a-strong-security-posture/https://blog.iomergent.com/accelerate-growth-with-a-strong-security-postureHow to Create Customer Trust and Win New Business Chances are, if you are bidding on new business today, you’re being asked to fill out vendor security questionnaires and to demonstrate alignment, or even compliance, with your potential (and current) customers’ security programs, industry regulations, and risk appetites.Tue, 29 Apr 2025 11:45:00 GMTJon Rose