One of the best habits I have developed over my professional career has been keeping a diary of what I do at work. At the end of every day, I make an effort to think what I have done in the day and write it down. This allows me to understand where I spend my time and go back and see the diversity of tasks I have been working on. With the demands of reporting often we are under, this has become a valuable tool for me.
I joined Fresha four years ago as a principal security engineer, and ever since, I have kept a good written record of what I have done every single day. While in the shower this morning, this thought came to my mind: in the AI age we are living these days, what would I do differently if I had to start all over again? How would AI help me run and accelerate the security program when you are flying solo and you are the security team? How can modern startups better protect themselves with one principal security engineer plus AI?
Let me start by clarifying that when I say AI, I mean Generative AI, mostly based on Large Language Models (LLMs). There are other AI techniques, such as the traditional machine learning, that I am not an expert on, so I won't touch those.
Generally speaking, the environment for a startup in its initial years is one where high risk is accepted. Speed to market is a fundamental metric. Low friction to users, customers, and developers alike is a must. Yet, the system has to be secure.
How do you balance all of these competing forces? Well, you don't. You do the best that you can as you consider the risks of doing something versus not doing it. And as you really understand how the business works, and how it makes money, then you are part of that fabric that makes decisions. Ultimately, it is the business who should make decisions that affect the most critical risks — the risks that can kill the company altogether. Within those risks, we'll find financial risks, people risks, technical risks, geopolitical risks, and of course, cyber risks.
In this article I would suggest three things a principal security engineer could do, assisted by AI, in their first three months. It is based on my experience as I did them myself. If we add AI to the equation, the results can be accelerated 10x or more. These three things are:
- Analyse the current architecture to know your crown jewels
- Do threat modelling to understand how the business works
- Logging, logging, logging
Crown Jewels
The first one is to understand what your crown jewels are by analysing the current architecture, what is out there deployed.
When I talk about crown jewels, I'm referring to the assets that, if compromised, would cause the most significant damage to your business. This isn't just about the most technically sophisticated systems or the ones with the most security controls around them. Crown jewels are the systems, data, and processes that are truly critical to your company's survival and success.
In my experience at Fresha, identifying our crown jewels required looking beyond the obvious candidates. The challenge with startups is that your crown jewels often evolve rapidly as the business grows and pivots. That experimental feature you built last quarter might suddenly become a core revenue driver, transforming from a nice-to-have into a must-protect asset almost overnight. This is why the analysis can't be a one-time exercise; it needs to be an ongoing process that adapts to your changing business landscape.
I've learned that crown jewels fall into several categories. There are the obvious data assets like customer information, financial records, and intellectual property. Then there are the operational systems that keep the business running, from your core application to the infrastructure that supports it. But don't overlook the less obvious crown jewels: your reputation, your relationships with key partners, your regulatory compliance status, and even the knowledge that exists only in the heads of key employees.
The process of identifying crown jewels starts with understanding your business model at a granular level. How does money flow through your organisation? What are the critical paths that customers take through your systems? Which processes, if disrupted, would prevent you from delivering value to customers or collecting revenue? I've found that sitting down with business leaders and walking through their day-to-day operations often reveals dependencies that don't show up in any technical documentation.
From a technical perspective, this means mapping not just your current architecture, but understanding how each component contributes to business outcomes. It's not enough to know that you have a microservices architecture with hundreds of different APIs. You need to understand which of those APIs handle customer onboarding, which ones process payments, which ones manage your core business logic, and which ones are just supporting functions that could be temporarily unavailable without major impact.
How AI can help
When I first started at Fresha, understanding the architecture meant countless hours reading through codebases, documentation, and having long conversations with engineers. Today, AI can dramatically accelerate this process. You can (almost) feed entire codebases into modern LLMs and ask them to map out data flows, identify sensitive data handling points, and highlight potential security-critical components (I'm very interested in this kind of work, by the way).
What's particularly powerful is using AI to process meeting transcripts and technical documentation simultaneously. After speaking with different teams about their services, I can feed those conversation summaries along with the relevant code into an LLM and ask it to identify discrepancies between what people think their systems do and what they actually do.
Threat Modelling
The second one is to understand how the business and what you are trying to secure work, and where the risks are. You can do that by meeting with business leaders and technical teams. But one of my favourite activities is running threat modelling sessions.
I have run and continue to run threat modelling sessions where I meet with an engineering team to discuss a feature they are going to start working on. That's the ideal time for a threat modelling session — when there is no code, and the engineering team is fleshing out the scope of work. We then discuss what they are about to implement, what things can go wrong and how they can be abused by threat actors, and what we can do to prevent it.
How AI can help
Recording and transcribing threat modelling sessions was always something I wanted to do but never had the bandwidth for. Now, AI makes this trivial. I can record our discussions, and within minutes have a structured summary that captures the key threats we identified, the mitigations we agreed upon, and any follow-up actions required.
But where AI really shines is in the analysis phase. After uploading the session transcript along with relevant system diagrams and code snippets, I can ask the AI to identify threats we might have missed. It's particularly good at suggesting attack vectors that combine multiple components in ways that might not be obvious during the discussion. Google's Gemini 2.0 Pro, with its expanded context window, has got the potential to hold entire system architectures in memory and reason about complex attack chains that span multiple services.
The AI also helps me prepare better for these sessions. Before meeting with a team, I can feed it their system design and ask it to generate a preliminary threat model. This doesn't replace the collaborative discussion, but it gives me a head start and ensures I'm asking the right questions. Sometimes the AI spots patterns from other similar systems I've worked on, bringing that institutional knowledge into the current discussion.
Static code analysis powered by AI is another game-changer. Traditional tools flag potential vulnerabilities, but AI can understand context and business logic in ways that rule-based systems cannot. It can tell you not just that there's a potential SQL injection point, but also assess the business impact if that particular endpoint were compromised based on the data it has access to.
Logging, logging, logging
The third one is to start increasing operational visibility. Add more eyes that can tell you what is happening, increase the logging efforts, add alerts, get acquainted with the SIEM if the company has one. A strong, strong recommendation: adopt a logging standard for your security events. In our case, all our security events are numbered (e.g. SEC-EVE-xxx), the events have got a description that you can read in the event generated, and have a common structured that can be parsed in alerts (e.g. they all include the event ID, description, and IP, plus anything else specific to the event type). This will help you a lot when doing security investigations and developing the alert system (e.g. looking for anomalies).
How AI can help
This is where AI has perhaps could make the biggest difference in my day-to-day work. Writing logging code used to be one of those necessary but tedious tasks that would slow down feature development. Now, I can analyse a service's codebase and ask AI to generate comprehensive logging implementations that follow our SEC-EVE standard. It understands the business logic well enough to suggest where security-relevant events should be logged and can even generate the appropriate structured log formats.
The road ahead
The three areas I've outlined here form the foundation of any startup security program, but they're just the beginning. What excites me most about working in security today is how AI is changing the economics of cybersecurity for small teams. Tasks that used to require dedicated specialists or expensive consultants can now be handled by a single security engineer with the right AI tools.
The key is not to let AI replace your judgment, but to use it as a force multiplier for your expertise. It can help you move faster, cover more ground, and spot patterns you might miss, but the strategic decisions about what risks to accept and how to balance security with business needs still require human insight and business context.
If you're running security for a startup, remember that perfect security doesn't exist, but good enough security that enables the business to thrive absolutely does. AI is just the latest tool in our arsenal to help us get there faster and more effectively than ever before.
Disclaimer: The perspectives shared here are my own and do not necessarily represent those of my employer. I use GenAI as a tool to help me compose and structure my articles.