Legit question for tech department leaders. Our engineers have good solid knowledge on the security todo lists and does/don't. I saw the natural order of things where MVPs or quickly developed tools had to be refactored /redesigned to be more secure or at least up to standard. That's OK. However we are as strong as our weakest link.

As we scaled, each department (also non-tech) slowly started being more proactive, mini tools developed by managers, or leaders, e.g CRM workflows, random scripts, docs, sheets, and now vibe coded tools. All of these are now potential attack vectors. We add to this:

- Non-tech folks in the company, you impose rules, password managers and rotations, but you always have a small percentage of bad actors. - External users not putting good passwords, or using pwned passwords never changing them - Some product decisions or weaknesses built on purpose to facilitate usage of the tools (which goes against perfect security).

In our case it caused us being a target, we are under attack most of the time. We secured our tools under WAF with standard approaches (rate limits, blocking IPs, bot detection), but it feels like there's always a flaw/leak somewhere to fix.

With LLMs attacks are becoming more and more interesting, harder and hard to prevent or detect. We have a proper dev team, good at maintaining the codebase and libraries. You can imagine our mindset shifting from "full feature dev + good maintenance" to "some feature dev, a shit ton of security monitoring".

Our users are not tech savvy. Things like passkeys are sadly out of the question. Even MFA seemed out of reach at some point. Some of them sadly get phished from time to time, it angers us. We want to do more but it feels impossible.

Is there anything you guys did that helped? other than just securing and making it harder for attackers?