Constitute a security team -  Benefit is single point of accountability 

Most of the start-ups do not have a security team. The rationale is if the company is small, there is no need for security: Contrastingly, smaller the company higher the risk of competitive threat due to loss of proprietary information. Smaller companies are ill equipped to handle security incidents which make them even more vulnerable. Companies, big or small need to have single point of accountability for security. It is a good idea to constitute a security team consisting of core team members whose job is full-time security and other cross-functional members. The security team should be headed by Chief Security Officer (CSO) who reports to CIO. CSO is accountable for security in the company. The other alternative is to make CSO report to CEO which can vest higher leverage to CSO and hence CSO can implement security without being biased by CIO's office.

Thought #1 - Should venture firms fund a start-up company without security team?