The Rise of Fractional AppSec Teams: Are They Essential for Small Companies?

Addressing the Challenges Faced by Small Companies in Application Security

Small companies that build software often struggle to integrate security concerns into their development process due to limited access to expertise and financial constraints. As a result, these businesses tend to prioritize innovation and business growth over security, accumulating substantial technical debt. The introduction of application security professionals at a later stage may only allow for surface-level fixes or the addition of security controls, unable to address deeper security issues. This predicament reflects a recurring problem in the industry, compounded by the competition for security talent from major tech companies like Microsoft, Amazon, Apple, and Google.

Recognizing the Need for a Different Approach

Kymberlee Price, a seasoned professional in the field of product security and application security, acknowledges the scarcity of experienced application security personnel and the mismatch between the requirements of small businesses and the capabilities of dedicated security professionals. According to Price, most small companies do not require full-time unicorn-level expertise but could benefit from the assistance of a fractional security consulting model. This approach allows businesses to access a fraction of high-level application security expertise and support to establish and operate a security program.

The Solution: Zatik Consulting

To address this issue, Price has co-founded Zatik, a consulting firm aimed at bridging the gap in software security for startups and smaller businesses. Zatik operates similar to a virtual Chief Information Security Officer (CISO) but with a focus on building secure software designs, implementing DevOps processes, establishing CI/CD pipelines, and deploying security controls.

While Zatik’s primary focus is enhancing the developer experience and ensuring secure software development, they also assist businesses in evaluating their technology stack, offering recommendations, and facilitating connections with relevant partners. Recognizing that security is a multifaceted issue, Zatik aims to cover various aspects necessary for a holistic, secure foundation, such as employee access control.

Enabling a Security-by-Design Ethos

Zatik’s ultimate goal is to instill a security-by-design ethos in smaller companies from their inception. By engaging with companies in the early stages of their growth, Zatik ensures that secure practices are ingrained in their engineering and management processes. This results in engineers who understand and incorporate security as a fundamental aspect of their work, rather than retrofitting security measures later based on demands from external security teams.

According to Price, this approach not only presents a significant business opportunity for Zatik but also has the potential to elevate security practices across the entire tech industry. By assisting small companies in adopting secure-by-design principles, Zatik aims to improve the overall security landscape in technology.

Editorial: Prioritizing Security in Small Businesses

The challenges faced by small companies in integrating application security practices can have severe implications for both their own operations and the wider tech ecosystem. While the allure of innovation and rapid growth entices small companies to focus predominantly on business development, overlooking security can lead to significant consequences, including data breaches, regulatory penalties, and reputational damage.

It is clear that small companies should prioritize security from the outset, even if they lack the resources to hire full-time security professionals. Building a secure foundation and adopting security-by-design principles early on can save substantial costs and effort in the long run.

Consulting firms like Zatik offer an excellent solution for small businesses by providing access to fractional security expertise. These firms understand the unique requirements and resource allocation challenges faced by small companies, offering tailored and pragmatic approaches to security implementation.

Government entities and industry associations should also play a role in raising awareness about the importance of security for small businesses. Offering accessible resources, guidance, and training programs can help entrepreneurs and development teams understand the risks and build security measures into their software development processes.