Hi Tilderinos,

I head up a small startup and we're looking to get some support for our data security. Up until now we've worked with small mom and pops that didn't have any requirements, but a few of our new clients have full data security teams and our infrastructure and policies/protocols aren't up to snuff. We reached out to a few consulting firms and they quotes us between $80-100k to get things set up and run us through a full SOC2 review. As a small company we don't really have that type of budget, more like $40-50k. I stumbled upon Vanta and Drata as alternatives and had meetings with their sales folks last week. Both of their offerings from setting up our protocols to monitoring and getting us through a SOC2 were only $16k.

Are platform based companies like Vanta or Drata enough to get us off the ground while we're still getting set up? Has anyone worked with them before and have any feelings one way or the other? Should we be signing on with a security consulting company - be it at a lower rate if we can negotiate it?
This is all quite new to me and any insight folks here can provide would be incredible useful.

I've been looking at job postings at tech companies. Many of them have pretty bad Glassdoor reviews
(and I tried pretty hard to play Devil's Advocate while reading!). I think there's no perfect company out there. Still, I notice a lot of mentions of overvaluation, layoffs / diminishing culture, stressed employees / long hours, insurmountable tech debt, junior / inexperienced leadership, "toxic" culture, Hire-to-Fire 15% PIP cultures, etc. I feel differently about a lot of companies I used to aspire to join.

In the midst of all that, I also then see small startups. 10, 20 people. It sounded like way too much work at first, but I know some people who seem pretty fulfilled by such a setup and not (visibly) half as stressed as I was at a ~70 person mismanaged startup (although engineering headcount was pretty small). Some part of me wonders if a small company, even of strangers, would actually be less stress because we wouldn't yet have made the mistakes on culture mismatch, growing headcount, adding features to get growth that may never come, etc.

edit: adding clarification

Oh yes, to be totally clear-- a lot of the Glassdoors / Blinds were actually for large tech companies, including but not limited to "startups" originating from 10 years ago. Some were also smedium sized (~6 years old, ~50 people, typically Series A or earlier) so had been doing the startup thing long enough where you can see the team is starting to fray.

In my post, it's basically a slightly unhealthy comparison between older companies that have had lots of time to screw up, and companies that have not yet publicly or irrevocably screwed up (the small, new startups). Of course, I'm then kind of assuming I won't be the reason something fails when I totally could be lol.

The theses I would like to discuss goes as follows (and I'm paraphrasing): during the last 15 years, low interest rates made billions of dollars easily available to startups. Unfortunately, this huge influx of venture capital has led to no perceivable innovation.

Put cynically, the innovation startups have brought us across the last 15 years can be summarized as (paraphrasing again):

• An illegal hotel chain destroying our cities
• An illegal taxi company exploiting the poor
• Fake money for criminals
• A plagiarism machine/fancy auto-complete

Everything else is either derivative or has failed.

I personally think spaceX has made phenomenal progress and would have probably failed somewhere along the way without cheap loans. There's also some biotech startups (like the mRNA vaccines that won the race to market during covid) doing great things, but often that's just the fruits of 20 years of research coming to fruition.

Every other recent innovation I can think of came from a big player that would have invested in the tech regardless, and almost all of it is "just" incremental improvements on several decades old ideas (I know, that's what progress looks like most of the time).

What do you think? Do you have any counterexamples? Can you think of any big tech disruptions after quantitative easing made money almost free in 2008?

And if you, like me, feel like we're stuck on a plateau - why do you think that is?