Startups Scale Too Early. The Basics Are Still Broken

Mehmet Gonullu hosts The CTO Show from Dubai. Episode 603 spends close to an hour on one question: why do companies keep reaching for scale before the basics are working?

The argument

Most of what breaks a young company is unglamorous. AI-native threats are real and worth tracking, but they are not what takes companies down. Unpatched systems, weak credentials, and thin MFA adoption still do.

The same shape repeats outside security. Positioning nobody can state in a sentence. A sales hire made before anyone knows how the product sells. Features added before the core problem is solved. Decisions that stay in the founder's head instead of becoming systems.

Treated separately, those look like four problems in four functions, each with its own owner and its own fix. The conversation treats them as one. Every item on that list is a sequencing failure: a step taken before the step it depends on. Security, go to market, and product discipline each have to hold before you scale people, spend, or complexity, and no amount of effort in one substitutes for a missing step in another.

Which is where the distinction the episode keeps returning to comes in. Motion is not progress. Motion becomes progress only when a step proves a specific assumption, and a company can generate a great deal of the first while producing none of the second.

What it covers

• Why basic hygiene, MFA, SSO, credential management, still accounts for more breaches than anything AI-native.
• What defensible security means at startup scale, and why enterprise-grade control sets are the wrong target to copy.
• Why a salesperson cannot fix unclear positioning or an unfinished read on customer pain.
• How founders become the bottleneck, and what has to be written down for that to stop.
• Where fractional leadership fits when a company needs the expertise before it can carry the headcount.

Hosted by Mehmet Gonullu. Published 31 May 2026. The topic list above is adapted from the show's own episode notes.