The Email I Almost Deleted For Good
Once a month, an email lands in my inbox from a company called RoboShadow. Subject line: "Vulnerability Report." For the first few months, I skimmed it and archived it without reading past the subject line.
Then I opened one properly.
The report scans the external IP address behind stepituphr.com against the top 1,000 most common ports. Status: green. Zero open ports. Zero CVEs detected. It ends with three quiet nudges: run a full 65,000 port scan for complete coverage, keep the firewall and firmware current, keep the software patched.
Nothing more. No drama. No breach notification. A machine checking the locks on my front door and confirming they're still locked.
I nearly turned the emails off. I'm glad I didn't. Here's why so many founders make this mistake anyway.
Security Is Treated Like a Project, Not a Habit
Most small companies handle security the way people handle a will: they know they should have one, they mean to sort it eventually, and they only act once something forces the issue.
The numbers back this up. According to StrongDM's small business cybersecurity research, 47% of businesses with fewer than 50 employees allocate zero budget to cybersecurity. Citing Verizon's Data Breach Investigations Report, the same piece notes 95% of cybersecurity incidents at small and midsize businesses cost somewhere between $826 and $653,587. Wide enough range to keep any founder awake, and wide enough for most people to round it down to "fine, no doubt" and move on with their day.
The global picture isn't kinder. IBM's Cost of a Data Breach Report 2025 puts the average breach at $4.44 million, a 9% drop from the 2024 record of $4.88 million. Falling numbers sound like good news, until you remember "average" includes plenty of companies far smaller than the ones people picture when they hear "data breach."
If you run a company holding employee data, customer data, or anything else someone might use against you, you are already a target. The only open question is whether you find out from a monthly automated email or from a lawyer.
Small companies assume attackers go after bigger fish. Automated scanning tools don't care about your headcount. They sweep the entire internet for open ports and outdated software, and a five-person startup with an unpatched server is an easier target than a bank with a full security team. Size doesn't protect you. Attention does.
The Value Was Never What It Found
Here's the part I didn't expect. The value of this monthly email was never about what it found. Most months it finds nothing, because stepituphr.com is small and sensibly built, without much of an attack surface to speak of. The value is having a habit of looking in the first place.
Think about what happens without this habit. A server goes unpatched for six months. Nobody notices, because nobody's looking. A dependency has a known vulnerability disclosed publicly, and it sits there quietly for a year because nobody runs the scan which would have flagged it. None of this requires a sophisticated attacker. It only requires nobody paying attention long enough for a known, published, searchable weakness to sit exposed.
Compare this to a pattern I see everywhere in leadership. Most managers treat feedback the way most founders treat security: something for the annual review, not the daily routine. Wait a year, gather it all up, hope nothing's gone wrong in the meantime. Same failure mode, different shirt. You don't build a secure system, or a trusted team, by checking once a year and hoping for the best. You build both by making the check boring and routine.
This is the entire thesis behind Step It Up HR and the BAT feedback framework I've spent the last few years building: small, continuous, low-stakes checking beats a once-a-year audit, whether you're measuring open ports or team morale. A green scan result once a month isn't thrilling. It's also precisely what you want, over and over, until the one month it isn't green, and you're glad you caught it early instead of hearing about it from a customer.
Security Debt Is Technical Debt
Engineering leaders already have a name for the pattern where you skip the boring maintenance work because the urgent feature work always wins the argument: technical debt. Security is the sharpest edge of this same debt, and it's the one leaders defer longest, because unlike a slow database query or a tangled module, a security gap sends no warning signal at all. Nothing gets slower. Nothing breaks in a demo. It sits there, silent, until someone finds it who isn't on your team.
I've sat in enough engineering leadership meetings to know how this plays out. Roadmap review comes around, and "patch the dependencies" loses to "ship the feature the sales team promised." It loses every time, because the cost of skipping it is invisible until the day it isn't. A monthly scan makes this cost visible again. It puts a number and a status on the board next to the feature work, so leaders no longer get to pretend the choice isn't being made.
Where I Fell Short
For a while, I was the founder filing these reports under "deal with it later." I run a technology company. I've spent decades writing and reviewing code. If anyone had a reason to know better, it was me. I didn't skip security because I doubted its worth. I skipped it because nothing bad had happened yet, and nothing bad happening feels a lot like nothing needing to change.
Here's the trap, worth naming plainly: the absence of a breach isn't proof of safety. It's proof you haven't been tested yet, or you got lucky, or both. A clean scan result is a snapshot, not a guarantee. New vulnerabilities surface constantly. Software goes stale the moment you stop patching it. A monthly scan only stays useful if you keep running it, keep reading it, and keep acting on what it tells you, even when the answer is "nothing to see here."
What I'd Tell Any Founder Reading This
Run the scan. If you don't have an automated external vulnerability scanner pointed at your public-facing systems yet, set one up today. It costs little, takes minutes to configure, and gives you a monthly signal instead of a once-a-year guess.
Read the report. Not the subject line. The findings themselves, even the boring ones.
Act on the nudges. My scan keeps telling me to run the full 65,000 port version instead of stopping at the top 1,000. I hadn't done this before sitting down to write about it. I'm doing it this week, since admitting your own excuses in public has a way of ending them.
Treat security like feedback, not a fire drill. The companies who get hurt aren't usually the ones with the worst systems. They're the ones who stopped looking.
I'm not a security consultant, and this isn't a pitch for RoboShadow specifically. It's a pitch for the habit itself. Whatever tool you pick, pick one, and read what it sends you.
When did you last check the locks on your own systems? Not the annual audit everyone forgets by February. The habit.