Frequently asked questions | Jared Smith

Question 1

Should a pre-Series-A AI startup hire a fractional CISO instead of a full-time one?

Accepted Answer

Yes — full-time CISOs cost $200–400K all-in and are over-leveled for the work pre-Series-A founders actually need done. A fractional vCISO at $2–4K/month covers SOC 2 readiness, vendor security review responses, and security hiring decisions through the first enterprise deals.

Question 2

What does SOC 2 Type I cost for a 15-person AI startup?

Accepted Answer

$25–45K total over a 90-day window when scoped as a sales project, not a security project. That includes auditor fees, tooling (Vanta or Drata), and the operator time to assemble evidence.

Question 3

Is SOC 2 worth it before our first enterprise deal?

Accepted Answer

Yes when there is a named enterprise prospect waiting on it; no when scoped speculatively. SOC 2 is a revenue tool that unlocks pipeline you can already see — the ROI math breaks down without a real deal pulling it forward.

Question 4

How does an AI-native company actually run security?

Accepted Answer

Four layers: prompt injection defense, agent credential scoping, secrets handling, and audit logging — none of which the classic appsec playbook covers natively. The 90-day plan starts with credential scoping because that's where the largest blast-radius incidents originate.

Question 5

When should an AI agent be trusted to act autonomously?

Accepted Answer

On a four-level autonomy ladder: read-only, bounded write, state-changing, and public-facing. Promotion between levels requires explicit failure-mode tests, not vibes. Five signals — escalating retries, hallucinated tool calls, scope creep across sessions, silent error swallowing, and confidence inversions — mean a human takes the wheel immediately.

Question 6

Does AI let an engineering team ship more with fewer engineers?

Accepted Answer

No — it lets the same number of engineers ship more, while creating new surface area (eval pipelines, prompt regression, agent supervision) that requires senior judgment to manage. Companies cutting headcount on the "AI multiplier" thesis will get outpaced by ones that hold headcount and absorb the new work.

Question 7

What's the right hiring order for a pre-Series-A AI startup?

Accepted Answer

Founding engineer → second backend generalist → first frontend specialist → infra/platform → first PM → second backend cluster → first eng manager around hire 8–10. Compensation framework is equity-heavy through hire 5, then base-heavy. Avoid hiring a Director of Engineering before there are at least two ICs to manage.

Question 8

How do you triage an unfamiliar codebase quickly?

Accepted Answer

A 90-minute protocol: 15 min on README + recent commits, 20 min following the request lifecycle through the routing layer, 25 min on data model + migrations, 20 min on the test suite shape, 10 min on deploy and observability. Output is a one-page map plus three concrete questions for the team.

Question 9

What does an AI-assisted engineering workflow look like in practice?

Accepted Answer

Four to seven Claude Code or Codex sessions per day, scoped to discrete tasks at the right autonomy level, with the engineer reviewing every diff and running every test. Net effect: 2–3× throughput on greenfield work, 1.5× on brownfield, and a sharp drop in the kind of mistakes that come from human fatigue late in a session.

Question 10

When should we graduate from a vCISO to a full-time CISO?

Accepted Answer

When security work consistently exceeds 20 hours/week of operator time, when the company is past Series A with 50+ engineers, or when a regulated industry deal (healthcare, finance, federal) requires a dedicated executive on the org chart. Before then, a full-time CISO is over-leveled.

Frequently asked questions.