It's never too early to educate your employees about social engineering. My startup is small but has been targeted a few times by people trying to social engineer their way into more information.

An employee of one of our direct competitors even called one of my developers to try and extract information - good thing she caught on quick. We eventually tracked a number of attack vectors to either him or his company. They weren't the brightest attacks though (calling her from his work #, emailing her and other employees from email addresses which he'd used online, running port scanners and SQL Injection tests (etc) on our servers from company IP addresses).

Other times people call pretending to be customers, but they don't pass the smell test. We've had a few people call with tons of questions about our tech, capabilities, existing customers, etc, but won't divulge much of their own information or can't properly answer some of the basic questions that our real customers would know.

Early customers are kind of like a job interview, it has to feel right for both sides.