https://jacobmasse.com/blog/ Practical writing on SOC 2, ISO 27001, penetration testing, security operations, and building secure products, for startup founders and engineering teams. en Fri, 08 Aug 2026 00:00:00 GMT https://jacobmasse.com/blog/soc2-cost-canadian-startup.html https://jacobmasse.com/blog/soc2-cost-canadian-startup.html Fri, 08 Aug 2026 00:00:00 GMT A realistic 2026 breakdown of what SOC 2 actually costs a Canadian startup, auditor fees, tooling, and readiness, plus where teams waste money and how to keep the total down. https://jacobmasse.com/blog/do-you-need-a-pentest-for-soc2.html https://jacobmasse.com/blog/do-you-need-a-pentest-for-soc2.html Wed, 06 Aug 2026 00:00:00 GMT Whether SOC 2 technically requires a penetration test, why auditors and enterprise customers expect one anyway, and what a pentest for compliance should actually include. https://jacobmasse.com/blog/fractional-ciso-vs-full-time.html https://jacobmasse.com/blog/fractional-ciso-vs-full-time.html Tue, 04 Aug 2026 00:00:00 GMT A practical guide to choosing between a fractional (virtual) CISO and a full-time hire, the cost difference, what each is right for, and the signals that tell you it is time to switch. https://jacobmasse.com/blog/why-i-advise-cybersecurity-startups.html https://jacobmasse.com/blog/why-i-advise-cybersecurity-startups.html Fri, 07 May 2026 00:00:00 GMT I am now formally advising and consulting for early-stage cybersecurity startups. Here is what I actually do, why I do it, and what I look for. https://jacobmasse.com/blog/what-soc2-actually-means-for-startups.html https://jacobmasse.com/blog/what-soc2-actually-means-for-startups.html Fri, 20 Mar 2026 00:00:00 GMT SOC 2 Type II across 76 controls, 5-layer PR approval flows, and what founders consistently get wrong about compliance. Lessons from the field. https://jacobmasse.com/blog/mirai-botnet-kill-switch.html https://jacobmasse.com/blog/mirai-botnet-kill-switch.html Sun, 15 Mar 2026 00:00:00 GMT The story behind CVE-2024-45163: how I discovered a remote unauthenticated denial-of-service vulnerability in the Mirai botnet's command and control server. https://jacobmasse.com/blog/your-startup-doesnt-need-a-ciso-yet.html https://jacobmasse.com/blog/your-startup-doesnt-need-a-ciso-yet.html Tue, 10 Mar 2026 00:00:00 GMT What early-stage companies actually need for security versus what they think they need. Based on 20+ client engagements. https://jacobmasse.com/blog/operational-side-of-cybersecurity.html https://jacobmasse.com/blog/operational-side-of-cybersecurity.html Thu, 05 Mar 2026 00:00:00 GMT Security is not just pentesting and red teams. It is compliance, delivery management, cloud partnerships, audit readiness, and the boring work that actually keeps organizations safe. https://jacobmasse.com/blog/ddos-mitigation-lessons-attackengine.html https://jacobmasse.com/blog/ddos-mitigation-lessons-attackengine.html Sat, 28 Feb 2026 00:00:00 GMT What I learned building AttackEngine, an anti-DDoS SaaS that went from bootstrapped product to acquisition in under a year. Traffic fingerprinting, real-time detection, and multi-channel alerting. https://jacobmasse.com/blog/pentest-your-own-product.html https://jacobmasse.com/blog/pentest-your-own-product.html Fri, 20 Feb 2026 00:00:00 GMT A practical guide for founders and dev teams on penetration testing your own product. What to test, how to think about it, and when to bring in external testers. https://jacobmasse.com/blog/compliance-is-a-product-feature.html https://jacobmasse.com/blog/compliance-is-a-product-feature.html Thu, 12 Feb 2026 00:00:00 GMT Why treating SOC 2 and security audits as product features changes how you close enterprise deals. Lessons from building a 76-control compliance program at Humera. https://jacobmasse.com/blog/security-audit-60-assets.html https://jacobmasse.com/blog/security-audit-60-assets.html Fri, 30 Jan 2026 00:00:00 GMT The practical process of auditing domains, servers, and API keys across a growing organization. How to scope, what tools to use, and how to deliver findings that actually get fixed.