Startups historically are not the most security oriented