Think of a startup with twelve people, a functioning SaaS product, and a growing customer base. Everyone cares about security, yet no one holds “compliance