Scaling from 12 to 40 without hiring an analyst

When the org goes from twelve to forty engineers, the talk at the all-hands fixates on the org chart. New managers. New managers for the new managers. A VP of Platform. A director for every pillar that used to fit in two heads. The talk is wrong. The shape that doubles your velocity is rarely a new name on a chart — it’s the load-bearing shape of how you operate.

The first thing that breaks at the twenty-four-person line is the human queue. Twelve engineers and a single founder can hold the security queue in shared context — a Friday afternoon in Slack, a triage rotation that doubles as onboarding, a senior engineer who reads the alerts before lunch because she happened to see them. By thirty, that queue has knock-on effects: unanswered tickets, missed rotation handoffs, weekend pages that shouldn’t have been paged. The reflex is to hire a security analyst. The second reflex is to hire two, then three. Both reflexes are income-negative before the quarter is out.

What stays the same

Your architecture. Your blast radius. The threat surface you actually have, not the one a vendor’s pitch deck warned you about. The kind of decisions that take thirty seconds when you have the context and three meetings when you don’t. None of those change because someone added a thirteenth hire. A new analyst does not know that your checkout service talks to the fraud service over a private link, that the connector shipped as a six-handle deployment, that your dark-web watchlist lives in your finance team’s shared inbox because the founders have a manual on it from an earlier round. They have to learn all of that. The cost of the learning is the cost you already paid once.

What breaks

Visibility. When twelve engineers ship, the founder sees the diffs that matter. When forty ship, the founder sees the Slack channels they remember to open. The asymmetry is a function of headcount, and it scales linearly. The fix is not more detectives watching the diffs — it’s the same alerts a lean team would have used at twelve, scored against the running stack and surfaced as a single morning brief. The shape that doubles velocity is one morning per engineer per week, not a quarter of an analyst’s salary. Look at a sample brief → See the supported integrations.

The other thing that breaks is incident coordination. Twelve people know what to do when the fraud service is down — they’ve done it together. Forty people have less overlapping recall, more on-call handoffs, more documented runbooks that drift from reality. The fix is to make runbooks a living artifact: scored against actual incidents, reviewed in the same brief that surfaces them, replaced by the auto-handled path the second time they fire.

What changes that you didn’t expect

Procurement velocity. Twelve engineers approve software in a single Slack thread; forty engineers need a vendor review process, a security questionnaire, a procurement channel, an annual contract review. The cost of the new process is real and worth paying, but it shifts away from “we want a new tool” toward “we run the tool we picked.” The run of a single tool across a forty-person org is also the shape of the data the AI SOC scores well — fewer alert sources, more historical context per source, the morning brief gets more valuable, not less.

The right answer to “do we hire a security analyst?” at thirty engineers is almost never “yes”. The right answer is that the brief has to be unreachable, the auto-contain has to be a property of the system, and the on-call has to be a property of the founders’ calendar — not a property of someone who’s about to leave for a bigger role. Read the explainer for the parts of that — watch, auto-contain, triage, brief — that turn the queue into a product feature instead of a hiring plan. For the cost-and-headcount side of the same question, the insource-vs-subscribe read runs the arithmetic a CFO and a CTO can take into a budget meeting.