Leading security at two startups in a row, both acquired about two years after I joined

Krizo

I was 24 and had just finished my master's degree at the University of Copenhagen when I joined Krizo, in January 2019. I was hired as a software engineer and worked on both the backend and the front end.

Krizo sold crisis management software to businesses as a service. Companies used it to reach and coordinate their people during an emergency, such as a fire, an evacuation after a terrorist attack or a telecom outage, and Krizo also helped them train for such events with tabletop exercises. The software was used in moments when people's lives could be at stake.

The team was small: the co-founders and me. The backend was written in Haskell, which few companies in Copenhagen used, the front end in AngularJS, and everything ran on Docker Swarm on DigitalOcean.

Demos that crashed

In my first month I built an analytics dashboard. Krizo ran demos for the people who organise tabletop exercises at large companies, and sometimes the product crashed in the middle of one. I remember the room after one of those demos. Everyone found it embarrassing, and the question was a fair one: how can a company sell software for real crises, where lives are at stake, if it crashes during a demo?

The platform was the cause. On Docker Swarm a new deployment could take the application down, and we had little insight into what the containers were doing. My first project, in my second month, was to move to Kubernetes on Google Cloud. I wrote the configuration by hand and set up monitoring that we could read in Google Cloud's own tools. I also created a staging environment, because until then changes were tested on the developers' laptops and went straight to production, and I ran small clusters in more than one region so that a failing region would not stop the service.

The migration took about two months, and afterwards the platform was stable. Deployments no longer took the application down, and it scaled with the traffic. Some default settings caused small problems for a while, such as routing timeouts that sometimes dropped WebSocket connections. After the migration, Krizo raised an angel round.

The first security questions

Around the same time, larger customers started to ask whether we had any security program at all. Did we follow ISO 27001, or the NIST 800 series? We were young and had no idea what compliance meant in practice, so I took the questions on myself.

The customers sent procurement questionnaires, due diligence forms with a few hundred questions. Some I could answer from the engineering work, such as how we encrypted data at rest and in transit and which ciphers we used. Others asked for written policies, which a company of four or five people did not have. The first standard I read was the NIST guide on securing public web servers (SP 800-44). Then I wrote our policies, added the checks that were missing, and documented how code travelled from a developer's laptop to production.

Within three or four months I was the acting CISO, while I still ran the platform and built features. I kept the program lean, so that it did not slow the engineers down. During that period Krizo signed large customers, among them Boston Consulting Group, Vodafone, Palo Alto Networks and Danish companies such as the insurer Tryg.

I stayed at Krizo until August 2020, when I left to become CISO at Omnio. In early 2021, about six months later, Dataminr acquired Krizo for EUR 6 million, a large exit for such a small team.

Omnio

Omnio was another Copenhagen company, five years old when I joined in September 2020, and it built software for industrial IoT. A service in the cloud held a database of device data, and software installed on customers' factory floors knew how to talk to power meters and other equipment. It found the devices on the network, took their configuration from Omnio's database, set them up in a uniform way and streamed their data.

Because that software ran inside factories and other critical sites, customers checked Omnio carefully before buying, and large customers waited in the sales pipeline, blocked by those checks.

I was hired as CISO and as a software engineer, because I wanted to write Rust, which everyone wanted to write at the time. In my first week I took a coding task to learn how the company built and deployed its software. The servers ran on Kubernetes on Azure, the edge component was written in Rust and shipped as a Docker container, and the main service was a Django application with a Postgres database. I worked closely with the CTO, who had been with the company since its start.

The first months at Omnio

Within my first month I was mapping the information security management system (ISMS): writing down how we operated, finding the gaps and writing the policies to close them. At the same time I implemented, as an engineer, the technical controls that I knew the certificate would need.

Two weeks after I started, on 14 September 2020, I made the first commit to a separate Git repository for the ISMS documents, written in LaTeX, the format I knew from university. The documents described what I had observed, mapped it to the controls listed in Annex A of ISO 27001, and named who was responsible for each. The day-to-day operation of the ISMS ran in Google Drive, in spreadsheets that linked each control to the checks behind it.

By October we were already talking with the certification auditor, and I was answering the due diligence of companies such as ABB, Siemens and IBM, so that Omnio could be listed on their platforms. The technical controls, the risk register, the asset inventory and the first policies were enough for those reviews, months before the certificate. By the end of November the ISMS was in good shape. December went to Christmas and the holidays, the stage 2 audit took place from 20 to 22 January 2021, and Omnio received its ISO 27001 certificate.

This worked because the CEO backed the work and the company took security seriously. Operations were lean, and people had the authority to decide, so security did not become a bottleneck.

Controls that customers added

A certificate tells a customer that the house is in order. Customers still added controls of their own, depending on their risk and on their own customers. For an industrial customer, Omnio's software touched its data and ran on its factory floor, so the customer asked whether we could detect intrusions, whether there were safety switches where a fault could hurt people or damage equipment, and how we would notice a problem. In the autumn of 2020 one industrial customer sent supplier requirements that the Cyber Resilience Act now asks of every product sold in the EU, and we explore this story in chapter 2.11.

I also learned where to compromise. When a gap could not be closed before a deal, we could still sign, with a written commitment to close it within a quarter, two quarters or a year, and then we delivered what we had committed to.

Omnio in 2021

In 2021 I studied Microsoft's Security Development Lifecycle and adapted it to the way the team already worked, in short agile cycles with as little process as possible. We kept our threat model in OWASP Threat Dragon. I updated it on Mondays, when the week's tasks went out and we discussed them, and again on Fridays, when the tasks were done and checked. In between I filled in due diligence questionnaires as they arrived.

Omnio also wanted to reach US defence manufacturers. We finished projects such as MTConnect support for CNC machines to build that case, and I led the internal work on CMMC, the certification that the US Department of Defense requires from its suppliers, so that our partners could bid for defence contracts. For CMMC I read the NIST Risk Management Framework and the whole NIST SP 800-53 series over three months, and I built a proper risk management platform, moving it step by step from qualitative to quantitative risk. In the end CMMC blocked that route for us, and we went into 2022 without it.

Certifications that strangers trust

In the autumn of 2021, in a procurement call with a large customer, I walked through the tools we used to check our code, such as static analysis, and the customer's team did not trust what they heard. They pushed back on every answer. Then I mentioned that I was preparing for the CISSP exam, and the tone of the call changed: they said they were convinced. After that call I had to study and pass the exam. I passed it in February 2022 and was an Associate of ISC2 from then on, and I found the time to complete the full CISSP certification in 2026.

That call showed me what an authoritative certification is for. It lets a stranger trust what you say before they have the time to check it, and a company's ISO 27001 certificate does the same for the company in a customer's review. Looking back, both startups trained the same reflex in me: react fast when a demo or a deal is about to fail, and then put something solid behind what I promised.

IBM

In March 2022 the founders were preparing to raise corporate investment instead of more angel money, to partner with large IT and OT companies for distribution. Omnio was already available on platforms such as AWS IoT Greengrass, and it ran in customers' factories. Around June or early July the plan changed: instead of a round, IBM wanted to acquire Omnio. The news seemed too good to be true for all of us, and it came during the summer holidays, so for weeks things moved slowly and nobody knew what would happen.

The due diligence picked up in September. It covered much the same ground as our own ISMS, but every tool and scanner was IBM's, and I had to go through static analysis reports of about 2,000 pages and justify each false positive. Many findings pointed at HTML files inside the Rust libraries we depended on. Those files were the libraries' documentation, they never touched our code, and our product was written entirely in Rust. Most of the other findings were things we had already handled, often at a different layer, and we had the written justifications for them. All of it still had to be read page by page, years before language models could help.

In no time it was November, and I was an IBMer. I brought Omnio's edge software into IBM Maximo Application Suite, which meant meeting a large company's security requirements on a short deadline, including how the software was built and which cryptography it used. Chapter 5.8 describes those months, the buyer's questions and the techniques we used. After about four months I left IBM, moved back to Romania and founded KEIBISOFT, which is a story for another time.

Security as part of selling

At both startups the security work was tied to sales. In customer meetings I could see where the customer's money would come from and what the product still lacked, because I knew the product from the inside. That let me remove the security blockers between the customer and the contract, and then bring the product up to what those customers needed.

Writing an ISMS does not by itself get a company acquired. Customers stay sceptical and decide for themselves how much they trust a supplier. What moved the deals was the combination of records that customers could check and quick, honest answers when they asked for more.

I also stopped fearing audits. An external auditor is an independent assessor who checks that the company is in control of what happens inside it, and the certificate records that check. When the program grows with the company, from ad hoc work to a proper management system, the auditor finds little that the company does not already know.

The series

This series uses a made-up company, ACME, to show this work step by step. ACME starts as a webshop selling to households, a business with little regulation, then sells software to businesses, and later sells to public institutions. Regulated sectors such as finance and health add their own rules on top. At each stage the series shows the security work that becomes worth doing, the records it leaves and who reads them, so that the sales pipeline does not stall on a security review and the company can recover quickly when something goes wrong.

The plain chapters are written for founders and managers, and each one has an engineering companion for developers. Chapter 1.2 introduces ACME.