YSecurity is the security team that works next to yours. We're usually the right fit when a company is in the middle stretch: too much security and compliance work for the founder or CTO to carry alongside everything else, not quite ready to hire a full-time Head of Security, and too much enterprise revenue at risk to ignore it.
YSecurity
Computer and Network Security
San Francisco, CA 1,667 followers
The on-demand cybersecurity team for startups
About us
We are a team of cybersecurity operators from Silicon Valley. We integrate into companies as an extension of their team to address essential security issues, expedite compliance, and assist in closing enterprise deals without the necessity of recruitment.
- Website
-
https://ysecurity.io
External link for YSecurity
- Industry
- Computer and Network Security
- Company size
- 11-50 employees
- Headquarters
- San Francisco, CA
- Type
- Privately Held
- Founded
- 2022
- Specialties
- startup, compliance, SOC2, Product Security, Corporate Security, Cybersecurity, Infrastructure Security, FedRAMP, ISO42001, ISO27001, SOC 2 Type 2, Enterprise Cybersecurity, GDPR, HITRUST, CMMC, Blue Team, Red Team, and Risk Management
Locations
-
Primary
Get directions
San Francisco, CA, US
-
Get directions
1240 Northpoint Dr
Unit F
San Francisco, California 94130, US
Employees at YSecurity
Updates
-
Your deal isn't stuck because of pricing. The buyer's procurement team sent a security questionnaire 18 days ago. Nobody on your side owns it. The AE is following up on commercial terms. The buyer's security team is waiting on 47 unanswered questions. That's the deal. It's sitting in a queue on the buyer's side with a status of "pending vendor response." Security reviews are part of the sales process now. Treat them that way.
-
Security gets expensive when it becomes reactive. A buyer sends a 300-question security questionnaire. An enterprise deal stalls in procurement. An auditor finds gaps late in the process. Your team realizes nobody owns the security review. A customer asks for SOC 2 before renewal. YSecurity helps you get ahead of it with senior security operators who have done this before.
-
The SOC 2 dashboard turns green pretty early. The part that takes time is collecting the evidence the auditor will actually look at, access logs, vendor reviews, incident records across 6 months. That's where most programs slow down, and that's where we do the work. If you're in that phase: https://lnkd.in/gY5tVvXb
Most SOC 2 programs stall at the same place: evidence collection. Not the policies. Not the controls. The part where someone has to actually gather 6 months of proof that the controls ran. That's the part we handle.
-
We plug in so your team doesn't have to carry security by themselves. If SOC 2 is something you're planning to get to eventually, eventually is usually the wrong timeline. The companies that close enterprise deals started before a buyer asked. Let's get you moving: https://lnkd.in/gY5tVvXb
A founder told me last month he'd been putting off SOC 2 because "most of our customers don't ask for it yet." His next enterprise deal asked for it in the first procurement email. This is the sequence I've watched play out at least 20 times. The ask always comes before you're ready. The founders who close those deals started 6 months before anyone asked.
-
Most Series B founders don't have a security team. We are the one you'd hire if you did. At a fraction of the cost of a full-time CISO and without the 3 month search.
What a CISO actually costs at Series B, before benefits and equity: $280K to $350K base. For a company with 60 engineers and 3 compliance frameworks in flight, that math makes sense. For a 35-person AI startup that needs SOC 2 and wants to close 2 enterprise deals this year, you don't need a $300K executive. You need the work done. Those are different things. Are you trying to decide between hiring and bringing in outside help?
-
Most founders find out the observation window problem the same week they try to close a deal. The Type 2 report needs months of clean control evidence before an auditor will sign off. If the timeline matters to you, we should talk now: https://lnkd.in/gY5tVvXb
The SOC 2 Type 2 observation window is 3 months minimum. Which means the clock started ticking the day you turned on your first control. Most founders don't know that. They think they can start in October and be ready for a spring renewal. The math doesn't work. If you're hoping to pass before Q3, you needed to start in January.
-
We plug in so your team doesn't have to carry security by themselves. Jon described the Robust Intelligence acquisition well. What he didn't get into is what 2 months of enterprise due diligence actually asks for: a SOC 2 Type 2 with no deviations, a pen-test report no older than 12 months, documented incident response that's been tested, and a CISO-level contact the buyer's security team can call directly. We run all of that. For clients anticipating M&A or fundraising, we start the security program work 6 to 12 months ahead so that window doesn't catch them unprepared. If an acquisition or major round is on your horizon: cal.com/ysecurity/15min
Robust Intelligence was acquired by Cisco for $400M. Most people focused on the product. What the deal actually required was a SOC 2 Type 2 with zero audit deviations, a security posture that survived 2 months of enterprise due diligence, and a team that could answer a Cisco security review in real time. We scaled their security team from 2 to 8 operators overnight when the acquisition process started. Nobody plans for that window. By the time M&A diligence lands on your desk, you're already behind. The companies that survive it cleanly started their program 12 months earlier.
-
Your enterprise buyer's security team will ask for this. YSecurity is the security team that works next to yours so these answers are ready before the deal goes into review. Start before the DDQ lands: https://lnkd.in/gY5tVvXb
Three things enterprise buyers' security teams ask that most startups can't answer cleanly: Who has admin access to your production environment right now, and when was that list last reviewed? What's your process when an employee leaves? Has your pentest covered your current product, not the one you shipped 18 months ago? These aren't trick questions. They're table stakes for a $500K+ ACV. Most startups get one of the three right.
-
Pranava Adduri spent years at AWS watching Fortune 500 companies try to answer a question nobody had good tooling for: if I have 100 petabytes of data, which of it actually matters? He and George Gerchow joined us on the Security Podcast of Silicon Valley to talk through what they built at Bedrock Data, why data-first security is the only posture that survives an AI-heavy enterprise. Grateful to both of them for making time. One of the more technically grounded conversations we've had on the show. Full episode here: Spotify: https://lnkd.in/g-anTQu5 Apple Podcasts: https://lnkd.in/grRBQeZP
-