Most startups don't need a dedicated security person and don't need a service like ours to bridge them to a full-time internal security team. So I think you're right: boards and founders are going to question whether they want something like this.

On the flip side: we have the bandwidth for only a few clients (we're doing a lot of work here), so mutual selectivity is a win. :)