I have encountered startups to large corporations (outsourcing work) to prioritise speed, go-to-market and churning out as much code as fast as possible. In this scenario, any software developer can identify continuous increases in security vulnerabilities.

If one were to professionally take appropriate time for planning and security considerations, one is seen as "not being a team player" and/or "being too slow".

Is this common in the industry, particularly with the new rush to IPO, secure funding, gain large user base ("growth hacking")?

  • 7
    Unluckily, yes, for my experience it's a common practice. Security is still largely see as a cost.
    – Gianluca
    Jul 25, 2018 at 8:21
  • 1
    I thought the “rush to IPO” was a thing of the past, at least in the US. I’m curious, where are you seeing this?
    – Ben Mz
    Jul 25, 2018 at 9:17
  • 3
    IPO = Initial Public Offering, ie. "alpha release" in case someone is wondering. Jul 25, 2018 at 9:33
  • 1
    @JuhaUntinen “Alpha Release” is an overloaded term. It can also mean the first release of software to test in a traditional software release life cycle.
    – Ben Mz
    Jul 25, 2018 at 13:58
  • 1
    While the specific example here is about developing a software product the general question about favoring time to marker over risk mitigation is one that is general to most startups.
    – Ben Mz
    Jul 25, 2018 at 14:57

3 Answers 3


From what I have seen in the past, I believe the speed is more to do with a lack of understanding in security. Not only from management, but also developers themselves.

Management wants a working product and saying that you're doing it "right" doesn't sound convincing when they seen or believe a product can come out sooner. Take it from the perspective of a car. If a mechanic told you that he's working to make sure your car is "safe" for a simple tire change, you know it wouldn't take weeks to do. So they have to be convinced that it is in their best interest to make sure their products are done right.

Developers are going to school and not really told about security. In most cases, they teach how to handle proper input. Never about what happens when someone enters something improperly, either malicious intent or just hitting the wrong key. With that said, a lot of developers are making applications not knowing of potential security flaws that can be easily corrected.

It used to be hackers had to be sophisticated with their attacks. Maybe even having a high understanding of looking at source codes and determining exploits they can use against a system. That's no longer the case. A simple script kiddie can hit a web page and within seconds gain access to user data all because a developer didn't know about sql injections and management failed to hire a security firm or check. It happens to big companies too.


It's probably not true in the "rush to IPO" because I'm not aware of there being a "rush" when it comes to IPO. There are many, many regulations around that, and by the time a company is at that stage they have already attained a tremendous amount of users and revenue (if not profit!).

So it's unlikely that some new killer feature programming tool will be of any relevance in the timeline to IPO.

BUT as to growth hacking or, to put it more mildly, creating product-market fit, yes, you don't care so much about performance/security/architecture/extensibility/back-log.

Nor should you. Having a top-class IT team build a performant, scalable, secure system with beautiful design is just a waste of money if the system has no users/revenue.

On the flip side, having a wordpress site built in a week that shows that you have revenue/users is invaluable. It will help secure further funding. It will help determine if there is appetite for the product being built. It's the ultimate in agile development, really.

All that stuff - performance, security etc - is pointless if you have no users. Who cares if your database operates in O(n^n), you only have 10 users and 500 entries... same with security.

So it is common in the startup industry - in fact, it is almost necessary in the startup industry. The industry is now in a phase of low-funding (amazon secured half a million in funding from friends/family for an idea, good luck with that nowadays) and reliance on traction. There are arguments for/against this, but the reality for now is that this necessitates cut-down concepts over grand design.

This is not true, however, in established companies. If you're building software for a bank, for example, then security, performance, architecture - testing - these are all central concepts. After all, any software you build is going to be used - probably quite heavily and with need to be expanded in the future. In general, internal software for large corporates will need all the things that are considered best practices.


Nobody is going to buy a non-functional concept, so to get the product launched a lot of corners are often cut. Once the product is "stable", niceties like security, backup and documentation are implemented.

This is common, but an unwise practice in the long run (see GDPR). Welcome to start-ups.


Not the answer you're looking for? Browse other questions tagged .