3 Security Fixes Every SaaS Founder Should Make This Week

Synopsis

Cybersecurity consultant Kevin Riggle (ex-Akamai, Stripe, Lyft) argues most SaaS security advice is stuck in the 1990s, and offers three concrete interventions: enforce a password manager to stop password reuse, add a standing rule that money never moves without strong authentication (defense against wire-fraud spearphishing to bookkeepers), and rate-limit login and other auth endpoints against credential stuffing. He pushes back on SOC 2 and OWASP-style lists as the wrong starting point for small teams.