First Perspective: Startup Incubators

I reached out to a local startup incubator to learn how they assist new ventures. They mentioned an optional "information security" package, which surprised me given the apparent necessity of such support. Shouldn't incubators prioritize critical areas like security rather than treating them as add-ons?

Simultaneously, while interviewing with a prominent European incubator, I inquired about the presence of a Chief Information Security Officer (CISO). Although they had successfully nurtured over 200 startups, I was the first person to fill that role—primarily due to regulatory requirements from the EU financial authority.

During this time, Sweden faced a surge of hacking incidents. I offered my assistance to various Scandinavian incubators in exchange for feedback. Out of over 30 inquiries, only two responded. One, a municipality-sponsored incubator, claimed their security needs were addressed by local administration. The other, affiliated with a university, expressed interest in my insights.

I soon realized that most European incubators neglect fundamental information security principles. They prioritize taxation, accounting, employment, and, in some cases, social media, but overlook security.

Second Perspective: Overcoming Misconceptions

In conversation with the COO of a regional incubator, he asserted that startups often cannot afford to allocate scarce resources to what he deemed secondary issues—implying that concerns about information security were "unmeasurable."

This prompted me to reassess both perspectives. Many business leaders conflate information security with IT security, mistakenly believing that the latter necessitates significant financial investment in technology.

The fundamentals of information security, however, do not require hefty investments. Numerous European government-sponsored cybercrime prevention agencies offer basic awareness training free of charge. Yet, when executives associate information security with high costs, they often disregard it entirely—until a catastrophic breach occurs, resulting in millions in losses and compromised data.

At that point, management typically reassesses the situation, often concluding that their product or service needs to be entirely redeveloped, wasting years of progress.

What is the underlying issue? A handful of essential information security practices that could have been addressed early on.

Third Perspective: The Importance of Verification

I developed a presentation framework and introduced it to the business development manager of the university-sponsored incubator. After two meetings, I successfully conveyed its significance.

The response was encouraging:

"We hadn't considered that! It's crucial and original! When can you share this with our startups? We need this!"

However, a challenge emerged—I cannot undertake this alone. The topic and its importance necessitate skilled professionals and governmental support for effective delivery. Yet, many seem uninterested or unable to grasp the urgency of the message.

Cybersecurity expert explains what happened with the global IT outage - YouTube

This video features a cybersecurity expert detailing the recent global IT outages, shedding light on the underlying issues and the need for improved security measures.

Systems Thinking Approach

Professionals constantly combat cybercriminals, engaging in a relentless cycle of addressing the same issues. I have formulated a theory about hackers that remains largely unshared among my colleagues. The systems thinking approach presents an intriguing viewpoint: the ecosystem supports all its components, which in turn fosters improvement.

Hackers, in this context, serve as a corrective mechanism, compelling subsystems to optimize and enhance. The weak falter while the strong are given opportunities to evolve—an example of natural selection. Contrary to popular belief, hackers do not create vulnerabilities; rather, they reveal pre-existing ones.

Returning to the previously mentioned business approaches, brutal self-reflection can help prevent and rectify systemic flaws, while the "release first, fix later" mindset tends to exacerbate vulnerabilities.

Interestingly, the COO of the regional incubator suggested I misunderstood the significance of both approaches. He argued that brutal self-reflection stifles creativity, while the latter is essential for staying competitive.

Ultimately, I believe this topic warrants more than being yet another transient article on MEDIUM. I am in urgent need of skilled collaborators to effectively amplify this message.

I welcome your professional and personal insights. Am I overreacting, or is the incubator manager correct in deeming this matter critically important? Are you also weary of those persistent, unfamiliar numbers intruding on your communication?