Embedding Security as a Growth Engine with Jon McLachlan

What if your security program was your best sales tool?

Most B2B SaaS founders treat security as a cost center, something to minimize, budget around, and deal with only when it bites them. Jon McLachlan has spent years making the case that this framing is exactly backwards, and the founders who get that earliest tend to scale the fastest.

This episode gets into the real mechanics of scaling SaaS companies with security embedded from the start, not bolted on. For technology CEOs and operators weighing build versus buy decisions, the conversation around fractional security teams versus in-house hiring is one of the most honest you will hear on the topic of B2B software scaling.

Jon McLachlan is the CEO and co-founder of Ysecurity.io, where he helps SaaS companies build practical embedded security and compliance programs without slowing down product development. He also leads Cyberbase AI, focused on the intersection of AI and cybersecurity, and co-hosts the Security Podcast of Silicon Valley, now over 90 episodes deep. Jon started Ysecurity almost by accident, helping founder friends who needed security guidance, and grew the team to more than 45 people through referrals alone.

Key Takeaways

Bootstrapping a security firm through referrals is possible when trust is the product: every client at Ysecurity has come through word of mouth, a signal that founders are handing over the keys to people they already believe in.

The fractional security team model solves a real gap in B2B software scaling: founders can rent an entire embedded security function, from vCISO to red teaming to GRC, without the complexity of building an in-house team from zero.

Checkbox security is a floor, not a ceiling: SOC 2 Type 2 and ISO certifications matter for sales cycles, but the real return on investment comes from integrating security into marketing, sales training, and product positioning so it opens new business.

Chasing enterprise clients when your DNA is startup-focused is a costly detour: Ysecurity tried repositioning for large publicly traded organizations, landed a few deals, and found the red tape incompatible with their speed and culture, a pivot that clarified everything.

Founder mental health deserves more airtime than it gets: with depression rates among tech founders estimated around 43 percent compared to roughly 9 percent in the general population, protecting personal recovery time, whether running, cycling, or scheduling unstructured space, is an operational decision, not a luxury.

Jon McLachlan said, "Security is not just this little box on the side that we should think of as a cost center. The right way to do this stuff is really to integrate it into the entire organization. It is an investment in every sense of the word, and you should expect it to pay off."

Host Scott Shagory said, "Sell security without selling security, to overgeneralize. If you can do that, it is just such a potent message, and to be able to really enable gains that are more challenging and yet at the same time provide genuine security, it is not just a checkoff list."