Building a security program from the ground up is challenging enough for a single organization. Doing it across multiple companies during a merger adds layers of complexity that most leaders never anticipate. Mel Reyes, Head of IT and Security, CIO and CISO at Getaround, brings over 30 years of experience navigating these exact challenges across Fortune 500s, startups, and nonprofits. In this episode, he shares hard-won lessons on what organizations consistently get wrong in cybersecurity and how to fix it before it costs millions.
You can read the complete transcript of the episode here >
What are the biggest challenges of security during M&A integrations?
Mergers and acquisitions create unique security headaches because each organization brings its own culture, tooling, and maturity level. Mel outlines a three-step approach to unifying security across multiple entities:
- Top-down mandate: Security has to be declared a priority from leadership. Without executive buy-in, no amount of tooling or process will stick.
- Cultural education: Different divisions have different risk tolerances and workflows. Everyone needs to understand the “why” behind security requirements, not just the “what.”
- Customized implementation: A one-size-fits-all approach fails. Each group needs tailored communication and processes that respect their existing culture while raising the security bar.
The key insight is that security during M&A is fundamentally a culture play. Technical controls matter, but shifting the security culture across organizations is what determines long-term success.
How should startups approach building a security program?
For startups handling sensitive data like PII or healthcare records, waiting until 100 employees to think about security is already too late. Mel recommends a phased approach:
- From day one: Accept that systems need to be locked down. Document decisions and maintain at least a baseline intent around security.
- At 10-30 people: Partner with someone immediately. This could be a modified MSSP, a DevSecOps group, a VC advisory board, or a cloud advisory group.
- At 100+ people: If you haven’t started, expect painful refactoring. Data may be in the wrong regions, workflows will need restructuring, and engineers will resist changes.
The cost of retrofitting security is exponentially higher than building it in from the start. Organizations that skip early security investment end up with orphaned configurations, unmanaged endpoints, and a mountain of remediation tickets.
Should security be a top-down or bottom-up initiative?
The answer is both, but with distinct responsibilities at each end. Mel frames it as two critical path points that must work together:
- Top-down: Leadership funds security, sets direction, and ensures board-level awareness of risk management. They need to understand that a single attack can wipe out billions in value.
- Bottom-up: Engineers must think about security in every line of code. SQL injections, buffer overruns, and missing code scans are not new problems. Any engineer not considering security should revisit their approach.
The gap between these two ends is where most organizations fail. Marketing teams, operations staff, and everyone in between need to be security-conscious. But if leadership does not fund it and engineers do not implement it, nothing in the middle matters.
When is the right time to invest in security certifications?
Mel advises against waiting for a compliance deadline to start thinking about security. Instead, he recommends a graduated approach:
- Start with a framework: Pick something like NIST, CIS, or SOC 1. You do not need an expensive audit. Just understand what controls exist.
- Do a gap analysis: Identify which controls you are meeting and which you are not. Document the gaps and your risk tolerance for each.
- Grow incrementally: Target one or two additional controls every quarter. Make it part of the culture rather than a panic-driven project.
The worst scenario is reaching 100 people, about to sign a major government contract, and realizing you need compliance from scratch. At that point, the cost and disruption are enormous.
What are organizations still getting wrong in cybersecurity?
Even organizations that take security seriously make predictable mistakes. Mel identifies three persistent failures:
- Dismissing concerns: When someone raises a security issue, whether they are a CISO, an engineer, or customer service, leadership must listen and act. Dismissal is the fastest path to a breach.
- Excessive risk tolerance: Some organizations accept risks they should not. Mel’s response: “Prove it to me. Show me the log, show me the system.” Assumptions about security controls are dangerous.
- Blind trust in vendors: Default configurations, unchanged throttle levels, and unreviewed vendor settings create hidden vulnerabilities. The mantra should be “don’t trust and reverify” on a regular cadence.
For companies under 1,000 employees, a single incident can cost seven to eight million dollars on average. Two incidents may make the organization uninsurable. The reputational damage compounds the financial hit as employees and customers lose trust.
What does “don’t trust and reverify” mean in practice?
This philosophy goes beyond the zero trust buzzword. It means actively questioning every assumption about your security posture:
- Review configurations regularly: Someone changed something in the last month or quarter. Network settings, cloud configurations, and access controls drift over time.
- Audit vendor claims: Just because a vendor says they have DLP or monitoring does not mean your license level includes it or that it is properly configured.
- Check for orphaned resources: Projects and instances that fall outside your monitoring umbrella are invisible attack vectors.
The practical cadence depends on the system’s criticality: monthly for critical systems, quarterly for important ones, and at least annually for everything else. Zero trust as a concept is powerful, but implementing it overnight in a major corporation is not feasible. Start with the mindset and target incremental improvements.
What is the “see something, say something, do something” principle?
Mel distills his security philosophy into a simple action chain that applies at every level of an organization:
- See something: Stay alert to anomalies, misconfigurations, and potential vulnerabilities in daily work.
- Say something: Raise concerns without fear of dismissal. Create channels where building cybersecurity teams feel safe reporting issues.
- Do something: Document the concern, route it to the right people, and ensure follow-through. A reported issue that goes unaddressed is worse than one never found.
This principle works whether you are a junior developer noticing a missing code scan or a board member reviewing the quarterly risk report. The key is that each step must lead to the next. Awareness without action is just anxiety.
