Lean doesn’t mean small. Stop sizing security buyers by headcount.

I’ve sat across from 200-person companies where security is effectively one person doing everything, and 3,000-person companies where the identity function is still two people, on purpose, because that org decided to stay lean rather than because they couldn’t afford more. Same problem, same urgency, wildly different size. If you’re deciding whether a security tool is “for you” based on your employee count, you’re using the wrong filter, and most vendors are handing you that wrong filter on purpose.

Why headcount stopped predicting risk

Headcount tells you almost nothing about whether you need automated identity remediation. It’s a proxy that made sense when team size reliably tracked company size, and company size reliably tracked risk. That relationship is breaking down, and most vendors haven’t caught up.

What actually matters is structural, not numeric: no dedicated identity specialist, alerts piling up faster than anyone can act on them, and a security function expected to move at the speed of the business without the headcount that used to come with that expectation. If that’s your team, you’re not “not big enough yet.” You’re a company that decided not to scale headcount the way security teams used to, and in a lot of cases that was the right call.

I think this matters more than most vendors want to admit, because the entire enterprise security industry was built around an assumption: team size scales with company size, and company size scales with risk. That assumption is breaking. Companies are running leaner on purpose. Automation, AI tooling, flatter orgs, all of it means “how many people do you have” stopped predicting what it used to predict.

How to actually evaluate a vendor’s fit for your team

So if you’re evaluating a vendor that defines “enterprise” by headcount, or “SMB” by the same number pointed the other direction, ask whether they’ve actually looked at how your team is structured, or whether they’re just reading your org chart size off LinkedIn and sorting you into a bucket. The lean team isn’t a smaller version of the enterprise team. It’s a different kind of buyer with different constraints, and it shows up at every size, not just the small end.

The test that actually matters

Here’s the test, and it has nothing to do with your employee count: does your team have someone whose full-time job is identity, or is identity one of five things one person is responsible for. If it’s the second, you’re the buyer this problem was built for, whether you’re 300 people or 3,000. Headcount didn’t tell you that. Structure did.

I’d rather you judge whether a tool fits your team by asking that question than by matching your employee count against someone else’s tier definition.