I've been thinking about how security evolves as a company grows. Most maturity models tie that journey to company size — headcount, revenue, funding stage. In my experience, that's correlation, not causation.
Companies don't strengthen security because they get bigger. They strengthen it because something forces them to — a customer sends a security questionnaire, an enterprise deal requires SOC 2, an incident exposes a gap, a regulator moves the goalposts. Each of those moments permanently changes the company's posture, and it tends to happen in a surprisingly consistent order.
This feels even more true in the age of AI. A 50-person company can now have the reach of one that used to need hundreds, so size is an even weaker signal for the security a B2B company actually needs. The trigger is the real driver.
Security rarely evolves because a company gets bigger. It evolves because something forces it to.
Seven domains, each on its own clock
One idea makes the rest click: security isn't a single track that levels up all at once. It's seven domains, each maturing on its own timeline, with its own controls. A trigger rarely advances all of them — it pushes two or three forward and leaves the others where they were.
With that map in mind, here's the climb — eight stages, told in four acts.
Act I · Getting noticed
Every company starts at security hygiene — not because anyone planned a security program, but because you can't operate a business without the basics. MFA everywhere, a password manager, disk encryption, automatic updates, and no shared admin logins. It's unglamorous, and it's the floor.
Then comes the first question. A prospect sends a security questionnaire, or an insurance application lands on your desk, and overnight security becomes a sales problem. Teams reach for SOC 2 Type I, turn on SSO, write an offboarding checklist, roll out device management, inventory their data, and brief everyone on phishing. In one stretch, identity, data, infrastructure, and people all take their first real step.
Act II · Getting tested
Enterprise ready arrives with your first big customer — the one who won't sign without a SOC 2 Type II. Now the controls have to be real and continuous: SSO enforced, role-based access, centralized logging, an annual audit, vendor review, security champions, data encryption, and out-of-the-box detection. Detection and compliance step onto the ladder for the first time.
And then, sooner or later, comes the incident — a real breach or a close call. The incident writes the roadmap you'd been postponing: a named IR owner, a written plan, an insurance-aligned response, and the first genuine alert monitoring or MDR. Response finally joins the party, usually under pressure.
Act III · Getting regulated
Hit a regulated market and you run into the regulatory wall. Compliance stops being a certificate and becomes a program spanning GDPR, PCI DSS, or HIPAA — identity governance and access reviews, data governance with DPIAs and retention, a multi-framework program, network segmentation, and secrets management.
Close behind is the response SLA. A contract, a regulator, or a questionnaire makes it official: detection isn't enough — someone has to respond, around the clock. That means an on-call rotation or MDR/MSSP, fleet-wide EDR, tabletop exercises, and runbooks you've actually tested.
Act IV · Getting institutional
At enterprise scale, the question becomes build or buy. Security turns into an organization: a GRC function, internal audit, PAM tooling, monthly board reporting, and dedicated detection engineering.
The final rung is the institution. The challenge shifts from visibility to prioritization, and compliance becomes continuous rather than a yearly scramble. Specialized sub-teams emerge — detection engineering, incident response, product security, insider risk — and here detection, response, and people stop being separate tracks and converge. Zero-trust identity, red teaming, and threat intel round it out.
The map at a glance
Every stage is triggered by an event, not by headcount. Save this as your reference for what's next.
Wherever you sit on this ladder, one rung shows up early and never leaves: someone has to actually investigate the alerts. That's the gap Fast is built to close — full coverage from stage one, long before you can staff a SOC.