Ask HN: How do you deal with cyber attacks once you scale?

A tech leader describes a scaling security problem: as the company grew, non-engineering teams created ad hoc tools - CRM workflows, scripts, documents and lightweight apps - that expanded the attack surface and became exploitable weak links. Internal risks include a small percentage of negligent or malicious employees and widespread poor password hygiene among external users. Product trade-offs that favor usability over strict security introduced intentional vulnerabilities. The organization now faces persistent attacks and increasing sophistication driven by large language models, which makes detection and prevention harder.

Engineering has hardened systems with a web application firewall, rate limits, IP blocks and bot detection, and maintains the codebase and libraries well, but vulnerabilities continue to appear in peripheral tools and human behavior. User base is not tech-savvy, so stronger authentication like passkeys is infeasible and even multifactor adoption is limited, leaving phishing successful at times. The team’s focus shifted from rapid feature development to intensive security monitoring, and they ask for practical, scalable measures beyond simply tightening defenses to reduce exposure and manage constant attack pressure.