Security audit secrets to success - a16z crypto

The article, an a16z crypto post by a reviewer with hundreds of security assessments over a decade, argues that companies can improve audit outcomes by preparing carefully before, during and after a review. It stresses setting realistic goals, such as getting a sense of key management security or finding ways to exploit smart contracts to siphon funds, rather than "find all the vulnerabilities." It advises engaging two or three vendors early, since specialized cryptography audits may require pushing timelines back by at least 2–3 months. It also says that communicating priorities to the auditors is "the single most important factor" for audit quality, according to the author's experience.