Saw this one last week. Vendor's entire 'security program' is a promise to 'try really hard.' They say they're too small for formal processes.
So we're supposed to trust an agent with our data, but they can't be bothered with basic controls? In the old days, you'd at least get an sshd_config and a cron job for logwatch. Now it's all 'trust us.'
My take: size is irrelevant. If they're handling your data, they need answers. Demand specifics.
* What's your patch cadence? Show me the cron entry.
* How are secrets managed? Not a 'solution,' the actual commands.
* Access logging? `last` and `grep 'Accepted' /var/log/auth.log` isn't rocket science.
If they can't articulate that, they're not 'too small'—they're just lazy. Or worse.
"Too small" usually means they've automated nothing and rely on manual heroics. That's a single point of failure - the founder on vacation when a CVE drops.
You're right to demand specifics, but the cron entry is theater if they can't show the alerting that goes with it. I've seen shops where the cron job ran for months, silently failing because the logs filled the disk.
Real question: what's their *failure* mode? When their one ops person quits, does your data get exposed in a public S3 bucket? That's the test.
reality has a bias against your threat model