Most of your security baseline is free. The expensive part is skipping it.

Security at pre-seed and seed is not a product you buy. It's roughly eight habits, most of them free, that close the doors attackers actually walk through. Multi-factor authentication on everything. A password manager instead of a shared spreadsheet. Access granted by role, not by convenience. Backups you've actually restored. Dependencies patched on a schedule. Secrets in a vault, not in the repository. Laptops encrypted and locked. One page describing who does what when something goes wrong.

Founders skip this because it feels premature, and because nobody has ever billed them for not doing it. But the bill arrives sideways — as a stalled enterprise deal, a security questionnaire nobody can answer, a diligence follow-up that costs you three weeks of momentum, or a compromised account that quietly forwards your invoices to someone else's bank details.

The right sequencing is simple. Do the free baseline now, this month, because it costs you almost nothing and it's what an actual attacker runs into first. Do a certification when a real deal or a real investor asks for it — in the UK that's usually Cyber Essentials. Do SOC 2 when an enterprise customer's procurement team makes it a condition of signing, and not one day before.

The eight things that are actually the baseline

The minimum posture is unglamorous and mostly free. Every one of these is available on plans a seed-stage company already pays for, and the total cash cost of the meaningful ninety percent is a password manager subscription and some hours.

• •
  Multi-factor authentication on everything.

  Especially the accounts that own other accounts: email, domain registrar, cloud provider, source code host, payroll, banking. Use an authenticator app or a hardware key rather than SMS.

• •
  A password manager for the whole team.

  A few pounds per person per month buys unique credentials everywhere, proper sharing instead of Slack messages, and one place to revoke access when someone leaves.

• •
  Least-privilege access, with a leavers process.

  Not everyone needs admin or production. Write down who has access to what, review it quarterly, and make offboarding a checklist rather than a memory test.

• •
  Encrypted laptops with screen locks.

  Built in and free on both macOS and Windows. Turn it on, verify it's on, and make it part of onboarding.

• •
  Backups you have actually restored.

  Having backups configured is not the same as having backups. Restore your production database into a scratch environment and time it. Until you've done that, you have a belief, not a control.

• •
  Dependencies patched on a cadence.

  Turn on automated dependency alerts and give the team a standing slot — half a day a fortnight is plenty at this size — to clear them.

• •
  Secrets out of the codebase.

  API keys, database passwords and tokens belong in a secrets manager, not in a file in your repository.

• •
  A one-page incident plan.

  Who gets called, in what order, who talks to customers, and where the backups are.

Doing this puts you ahead of companies far larger than you. Only 25% of UK businesses have a formal incident response plan, and only 31% put cyber security responsibility at board level.

What investors and buyers actually check

There's a persistent myth that investors run deep security diligence on seed-stage companies. Mostly they don't. At pre-seed and seed they ask whether the basics exist and whether someone owns them. What they're really testing is whether you're the kind of operator who handles the unglamorous things. A confident, specific answer passes. "We've been meaning to look at that" is the answer that generates follow-ups and drags out your process.

The real pressure comes from customers, and it arrives the moment you sell to anyone with a procurement function. Enterprise buyers send security questionnaires asking about access control, encryption, backups, sub-processors, onboarding and offboarding, and incident response. If you can't answer them, the deal doesn't die — it does something worse, which is sit in security review for months while your runway burns. In the UK there's a hard gate on top of that: central government and NHS procurement policy requires suppliers on contracts handling personal or sensitive data to hold Cyber Essentials, so public-sector revenue is conditional on it.

Certifications are a sales tool, not a security tool

Cyber Essentials is a self-assessment against five technical control areas — firewalls, secure configuration, security update management, user access control and malware protection — reviewed independently, from £320 plus VAT. UK organisations under £20m turnover that certify their whole organisation also get cyber liability insurance with 24/7 incident response included. Only 5% of UK businesses hold it, and 12% of small businesses, so it's a genuine differentiator in a sales conversation as well as a control.

SOC 2 is a different animal. It's the American standard, it involves an external auditor, and it is a real project: vendor guides put a Type 1 at roughly $10k–$25k, with first-year all-in costs materially higher once audit fees, compliance tooling and engineering time are counted. The trigger is a real prospect sending a real questionnaire with SOC 2 on it, not a hypothetical future enterprise motion.

The framing worth holding on to: certifications prove the baseline exists, they don't create it. If you have done the eight things above, both Cyber Essentials and, later, SOC 2 become paperwork exercises. If you haven't, certification becomes a panicked remediation project with an auditor's clock running.

The breaches that hit startups are boring

Almost nobody is writing bespoke attacks against a fifteen-person startup. Phishing is the most common attack type reported by UK businesses at 38%, and 69% of those affected called it the most disruptive thing that happened to them. Verizon's 2026 breach report found 62% of breaches involved a human element — error, misuse or social engineering. IBM's 2026 cost report found phishing has been the leading initial attack vector for four consecutive years.

Credentials and leaked keys do the rest, and they are patient. GitGuardian found that 64% of valid secrets leaked to public repositories back in 2022 were still valid and exploitable when retested in 2026. Leaked keys don't expire. They wait.

Which makes the habits that matter behavioural rather than technical. Treat urgency as a signal: almost every successful social engineering attack manufactures time pressure, so make it a company norm that any payment or credential request arriving with urgency gets verified through a second channel — a phone call to a known number, not the one in the email. And make it safe to report a mistake, because the most expensive thing in a breach is the hours between the click and someone telling you.

The playbook

1. 1
   Turn on MFA everywhere this week, starting with the accounts that own everything.

   Email, domain registrar, cloud provider, source code host, payroll, banking, and your password manager itself. Use an authenticator app or a hardware key rather than SMS. This is one afternoon and it removes the most common way small companies get compromised.

2. 2
   Buy a team password manager and delete the shared spreadsheet.

   A few pounds per user per month gets you unique credentials everywhere, shared vaults by team, and — critically — a one-click way to cut off a leaver. Credential reuse across services is what turns someone else's breach into your breach.

3. 3
   Get secrets out of the codebase and rotate what's already there.

   Ask your engineers to enable secret scanning on your repositories today, move API keys and database credentials into your cloud provider's secrets manager, and rotate anything that has ever been committed. Assume any key that touched a repository is compromised.

4. 4
   Test one restore, then write the one-page incident plan.

   Pick your production database, restore it to a scratch environment, time it, and write the number down. Then put on one page: who is called, in what order, who talks to customers, and the fact that UK GDPR gives you 72 hours from becoming aware of a qualifying personal data breach to report it to the ICO.

5. 5
   Book Cyber Essentials, and pre-write your security questionnaire answers.

   Certification is a few hundred pounds and forces you to fix the five control areas properly. While you're doing it, write down your answers on access control, encryption, backups, sub-processors and incident response. That document closes enterprise deals faster than the certificate does.

Security at seed stage isn't about being unbreachable. It's about not being the easiest door on the street, and being able to answer confidently when a customer or an investor asks. Both of those are available to you this month.