Jon McLachlan

Co-Founder Ysecurity & Cyberbase. Host of The Security Podcast of Silicon Valley

[Jon McLachlan @mclachlan_jon]

Most founders don’t lose deals because their security is bad.

They lose them because they can’t prove it’s good. Those are different problems and only one of them requires building something.

[Jon McLachlan @mclachlan_jon]

A pentest is only as useful as the scope that defines it. If the scope was written by someone who didn't know what to ask for, the report isn't telling you what you think it's telling you.

[Jon McLachlan @mclachlan_jon]

Every founder who told me they’d “deal with security after the Series B” has eventually called me before the Series B. 🤷‍♂️

[Jon McLachlan @mclachlan_jon]

What’s the worst piece of security advice you got early on?

[Jon McLachlan @mclachlan_jon]

Hiring a Head of Security at Series A is usually the wrong move.
$200K base before equity, and you don't have enough surface area to keep a senior person busy. What you have are 4 or 5 real risks. Fix those. Don't build a department around them.

[Jon McLachlan @mclachlan_jon]

Has anyone here gone through an enterprise due diligence call without a completed SOC 2?
Wondering how you handled it and whether the deal survived.

[Jon McLachlan @mclachlan_jon]

How much of your security work is actually getting done versus sitting in a doc somewhere?
Not a judgment. Genuinely asking. The gap between the policy and the practice is where every audit gets complicated.

[Jon McLachlan @mclachlan_jon]

Come see us today at @bsidesnash!

[Jon McLachlan @mclachlan_jon]

If you’re a founder who’s been through SOC 2, what took longer than you expected?

[Jon McLachlan @mclachlan_jon]

@KaiXCreator Depends what's blocking you. If you have pipeline and deals stalling on technical questions, it's the developer. If you have a product and no one's looking at it, it's the salesperson.

[Jon McLachlan @mclachlan_jon]

Your security team, on demand. https://t.co/rNHcTeH4hn

[Clifton Sellers @CliftonSellers]

You got 5 words

Sell me your service

[Jon McLachlan @mclachlan_jon]

@CliftonSellers Your security team, on demand. https://t.co/rNHcTeH4hn

[Jon McLachlan @mclachlan_jon]

Two patterns I see at Series A: ignoring security until a buyer's DDQ stalls a deal, or hiring a Head of Security before there's enough surface area to justify it. Both are expensive. Better to name the 4-5 risks that actually matter at your stage and get outside help for those.

[Jon McLachlan @mclachlan_jon]

Most compliance firms are selling time, not outcomes.
They’ll take 12 months because 12 months is what they bill. We’ve done Type 2 in 5. The difference isn’t effort. It’s whether the firm has done it enough times to know what actually matters.

[Jon McLachlan @mclachlan_jon]

It lowered the floor on effort and raised the ceiling on ambition. Nobody’s doing less work, they’re just attempting things they would’ve said no to two years ago.

[Daniel Smidstrup @DanielSmidstrup]

genuine question:

AI was supposed to make us work less

so why does it feel like everyone is working 10x more now?

[Jon McLachlan @mclachlan_jon]

Because more code faster = more surface area.
Security, validation, and oversight don’t scale automatically.

[Arun @hiarun02]

Why does Anthropic have 2,500 engineers.

if their own models are writing most of the code?

[Jon McLachlan @mclachlan_jon]

@buildwtim @X Message me if you need on demand security help 🔒

[Jon McLachlan @mclachlan_jon]

@Peter_Soida On demand security team 🔒

[Jon McLachlan @mclachlan_jon]

@sandislonjsak @pmarca 100%.
Work isn’t decreasing just compressing.
Risk is scaling just as fast.

[Jon McLachlan @mclachlan_jon]

@andruyeung New roles are being created around AI.
The same shift is coming to security.
Fewer static teams.
More on-demand, high-context operators.