"We don't need to worry about that now. We'll figure it out when we're bigger."
I hear it all the time. About security. About data. About how systems connect. About what happens if a key person leaves.
And I understand it. When you're growing, everything feels urgent, and stopping to plan for problems that might arrive someday feels like a luxury. Start small, prove it works, invest properly later. It sounds like discipline.
Then later arrives. And it sends a bill.
What "later" actually costs
Three examples I've seen first-hand:
The company that didn't think about data.
Every team built what it needed, with no thought to how information would flow between them. Three years on there were twelve databases and no single customer record - customer data everywhere and nowhere. Untangling it cost around $800,000 and six months of development, with new features on hold and a team running on fumes.
The company that was "too small to be a target."
Weak passwords, no multi-factor authentication. Then a contractor's laptop was compromised. Ransomware, two weeks of downtime, roughly $400,000 in recovery, a regulatory investigation and customers who didn't come back.
The company where one person knew everything.
Nothing was written down, because there was never time. Then that person gave two weeks' notice. It took around $200,000 in consultants to work out how things actually worked, and six months before the systems were stable again.
None of those companies made a single catastrophic decision. They made a series of small, reasonable deferrals - and each one was a bet that later would be cheap.
Why "later" is so expensive
It compounds. Technical debt behaves like financial debt: the longer you leave it, the more it costs to pay off.
Everything gets connected. What would have been a simple change early on becomes impossible without breaking five other things that now depend on it.
The business builds on top of it. You can't swap out the foundations without disturbing everything above them.
The people move on. The people who knew where the shortcuts were - and why - leave, and the knowledge goes with them.
The five places the bill usually comes from
1. Choosing easy over right.
Free or cheap tools for business-critical work. Quick fixes that quietly become permanent. Consumer-grade apps holding company data. Each is fine on its own - until you have to replace them all at once, mid-growth.
2. Letting every department choose its own tools.
Sales has one CRM, support has another, finance and operations have their own systems, and now each team has its own AI assistant too. Nothing talks to anything else. The result is duplicate data entry, reports that don't agree, and no single source of truth.
3. Treating security as a later problem.
"We're too small to be a target." You're not - small companies are often targeted because they're less defended. Then a big customer sends a security questionnaire you can't answer, and compliance becomes an emergency instead of a plan.
4. Building everything custom.
"Our business is unique." In the places that matter most to customers, it may be. In payroll, ticketing and file sharing, it almost certainly isn't. Every hour your developers spend rebuilding something you could buy is an hour not spent on what actually sets you apart - and every custom system is a maintenance commitment that never ends.
5. Ignoring the true cost of "free."
Open-source software with nobody to support it. Free tiers with pricing that jumps as you grow. Tools that only work because one developer keeps them alive. Your team's time is never free.
Taking shortcuts on purpose
The answer isn't to over-engineer everything from day one. Small companies don't need enterprise complexity, and moving fast is a real advantage.
The answer is to take shortcuts deliberately:
- Write down what you're deferring, and why. A one-page list is enough. If it isn't written down, it isn't a decision - it's an accident waiting to happen.
- Set a trigger for each one. "When we reach 50 staff, we consolidate onto one CRM." "Before our first enterprise customer, we get MFA and a security policy in place."
- Budget time to pay it down. A small, steady share of every month or sprint goes to cleaning up, so it never becomes a six-month rescue project.
- Say the trade-off out loud. "We're moving fast here, and this is the risk we're accepting." Leadership should know which bets are being placed.
And some things simply aren't worth deferring, because they cost about the same at 10 people as at 500 - but far more to retrofit:
- Multi-factor authentication and a password manager
- Backups you've actually tested
- One system of record for customers
- Clear ownership of company data and accounts - not on someone's personal login
- Basic documentation of how critical things work
The bottom line
The technology decisions you make at 10 employees will still be shaping your business at 100.
The companies that do well aren't the ones that never take shortcuts. They're the ones that take them on purpose, keep track of them, and deal with them before later turns into a crisis.
"We'll figure it out later" isn't a strategy. It's a bet that later will be cheap. And it's a bet most companies lose.
Related reading
- Every Organization Has a Sarah (And Why That's a Problem)
- The 45-Minute Tech Spend Checkup Every CEO Should Run
Wondering what your own "later" list looks like? Let's talk. An outside view before a big technology decision costs far less than untangling one afterwards.
Comments
No comments yet - start the conversation.
Log in to join the conversation.
Log in Create an account