Alastair Paterson, the San Francisco-based co-founder and chief executive of Harmonic Security, has warned that corporate cybersecurity chiefs are often too indirect with startups, saying their reluctance to give blunt product feedback can slow the development of new security tools at a moment when enterprises are trying to manage fast-moving AI and cyber risks.

Paterson’s comments, reported by Computer Weekly on May 11, came after the second UK Cyber Flywheel event, a forum intended to connect chief information security officers, cybersecurity founders, investors and government figures. The initiative is focused on helping young cyber companies form design partnerships with enterprise buyers, test products against real-world security problems and move more quickly from early concept to commercial deployment.

The argument is not limited to the United Kingdom. Paterson, whose company operates in the AI security market and has a San Francisco presence, has repeatedly framed the U.S. as the decisive market for ambitious cybersecurity startups. In a December 2025 interview with 909 Exec, he said Harmonic was building product in the U.K. while going to market in the U.S. from the start, reflecting a common view among cyber founders that Silicon Valley and major U.S. enterprise buyers remain central to category creation.

At the center of the issue is a familiar startup problem: early buyers may agree to meetings, pilots or informal conversations, but stop short of giving founders a clear answer. According to Computer Weekly, Paterson said CISOs often avoid saying a product does not work for them or explaining what would need to change before they would consider buying it. That leaves startups with ambiguity rather than the specific objections that could guide product, pricing, integration or compliance decisions.

For cybersecurity startups, that ambiguity can be expensive. Unlike consumer software, enterprise security products usually need to satisfy technical users, procurement teams, legal departments, privacy officers and executive risk owners before a deal closes. A founder may interpret a polite “keep in touch” as evidence of future demand, while the buyer has already decided the product lacks a key feature, does not fit the architecture, overlaps with an existing tool or would create too much operational risk.

Paterson’s proposed answer is the design partnership: a structured relationship in which security leaders engage earlier with startups, help shape a product around real problems and provide direct feedback on whether the solution could become deployable. In the best cases, such partnerships can give founders access to realistic environments and buyer priorities while giving CISOs early visibility into tools that might address unsolved threats.

That model is already part of the operating culture in parts of the U.S. startup ecosystem. Large technology companies, financial institutions, healthcare networks and cloud-native firms often test emerging security tools through controlled pilots, limited production deployments or innovation programs. But the model depends on candor. A design partner who avoids difficult feedback can consume a founder’s time without meaningfully improving the product or shortening the path to revenue.

The Cyber Flywheel initiative, according to Harmonic’s own April 14 account of its second round, brought together more than 150 senior leaders from the U.K. cyber ecosystem, including CISOs, founders, government representatives and investors. Harmonic said the discussions focused on barriers to adoption, procurement friction, earlier engagement between enterprises and startups, and turning broad support for innovation into measurable deployment pathways.

Those themes mirror longstanding challenges for U.S. cybersecurity founders. Even in Silicon Valley, where startup risk-taking is more culturally accepted, security buyers are not normal software buyers. A CISO evaluating a young company must consider whether the vendor can handle sensitive data, integrate with existing controls, survive a long sales cycle, support enterprise customers and withstand scrutiny from boards or regulators after a breach. That caution can be rational, but it can also make feedback vague and procurement opaque.

The stakes have risen with the spread of generative AI across corporate systems. Harmonic Security, which says it helps organizations adopt AI while protecting sensitive data, sits in a market where enterprises are trying to balance employee use of AI tools against data leakage, privacy and governance concerns. Startups in this segment may be closer to emerging user behavior than legacy vendors, but they need access to real enterprise workflows to understand where security teams will actually deploy controls.

Paterson’s background gives the critique additional weight in the cybersecurity market. Before Harmonic, he co-founded Digital Shadows, a digital risk and threat intelligence company that was later acquired by ReliaQuest. He has used that experience to argue that British and European cybersecurity founders often need to engage the U.S. earlier, where large enterprise budgets and venture networks can determine whether a company becomes a global platform or remains a regional provider.

For U.S. buyers, the message cuts both ways. Security chiefs do not have an obligation to become unpaid product managers for every startup that asks for a meeting. They also cannot expose their organizations to unnecessary risk simply to support innovation. But when a CISO does agree to evaluate an early-stage tool, the most valuable contribution may be a direct answer: what is missing, what is not credible, what would block procurement and what evidence would change the decision.

That kind of feedback can also improve the quality of the vendor market. Startups that receive clear objections can either fix real problems or stop chasing buyers who are unlikely to convert. Investors can better understand whether a company has genuine market pull. Enterprise security teams can avoid a cycle of endless pilots that produce little operational value. In a sector where threat actors move quickly and defensive tools often lag behind new attack patterns, faster learning loops matter.

The Cyber Flywheel discussion also highlights a broader policy question: how governments and large institutions can support cybersecurity innovation without distorting procurement or lowering standards. Harmonic’s April account said participants discussed public-sector pathways, procurement reform and clearer routes for startups to move from engagement to deployment. Those questions are familiar in the U.S., where federal, defense, healthcare and critical-infrastructure buyers all want innovative security tools but often operate under slow and complex purchasing rules.

The practical takeaway for Silicon Valley is that cybersecurity ecosystems are built not only on capital and technical talent, but on buyer behavior. Founders need access to people who understand urgent security problems. CISOs need ways to test early products safely. Investors need evidence that customer conversations are real rather than polite. Paterson’s criticism suggests that a more direct culture between security leaders and founders could make the difference between promising technology that stalls and products that reach the enterprise market in time to matter.