When does cloud security become a real concern for SaaS founders?

For SaaS founders, when does cloud security start becoming a real concern? Is it when the infrastructure starts growing, when enterprise customers ask security questions, or only after the first incident? Curious to hear how early-stage teams are handling this.