0
Too early and they're expensive overhead with limited impact; too late and you're retrofitting security into legacy debt. I'm curious what metric you'd use—ARR threshold, headcount, customer segment, compliance need? Bonus question: what should that first security hire actually focus on during months 1-6?