Grant Ongers, co-founder of Secure Delivery and a long-time OWASP community contributor, joins LeaderSpeak to discuss why conventional security gates fail to scale. He also shares the financial and personal realities of starting a consultancy, the challenge of wearing many professional hats, and a practical philosophy for making security better rather than chasing an impossible state of perfection.
Grant began working for himself early, initially helping small businesses build networks and PCs while he was still in high school. Years later, a rare conventional job helped him move his family from South Africa to the UK. Through OWASP Coffee, he met Toby Irvine, who would become his Secure Delivery co-founder.
Grant and Toby worked together on a large application-security programme. They shared the view that security based on stage gates could not scale across a large development organisation. Instead, they made expectations clear to developers and enlisted those developers in securing the product.
When they later left the organisation, they decided to apply the model elsewhere. Secure Delivery grew around the belief that teams building software should understand and participate in security rather than waiting for a separate function to approve or reject work.
The first concern for a new founder is often basic financial survival: rent or mortgage payments and food for the family. That pressure makes it difficult to reject ordinary contracts, even when those contracts consume time needed to develop the longer-term business.
Secure Delivery also entered its early months around the start of pandemic lockdowns, when finding new customers was unusually difficult. The company balanced contract work with deliberate investment in customer conversations. Grant credits that sustained effort with helping the team gain business and grow.
Grant’s daily work varies by client and project. On one day he might help automate OWASP ZAP testing. On another, he may act in a CISO-like role for a delivery-focused company, moving between ISO 27000 compliance, architecture questions, authentication, and mutual TLS. Free mornings may go to an OWASP application-security curriculum project.
Changing contexts this frequently has a cost. Grant acknowledges that the hours are not always healthy and that he shifts gears more often than ideal. An understanding family helps, as do intentional breaks and security-community events. The work remains sustainable in part because many of its activities also give him energy.
Grant offers two grounding ideas for people in information security. First, vulnerabilities will always exist; there is no final state of absolute safety. The job is to make measurable improvement. Accepting that reality can reduce frustration without weakening standards.
Second, the security team cannot secure everything alone. In many organisations, security practitioners are heavily outnumbered by developers. Security must therefore explain why its concerns matter and recruit the people building and changing systems. Developers—the “green team” in Grant’s framing—provide the scale needed to make progress.
Grant sees mentorship as reciprocal. Conversations with people entering or expanding their careers teach him about their work and expose better ways to approach his own. Security careers require continual learning, and useful guidance does not flow in only one direction.
