SMEs generally have very small budgets when it comes to IT and for Cyber Security, any budget is wrapped into that small IT budget because it’s seen as an IT issue.  That has long been a problem and only when it’s seen as a business issue, does it get the attention it deserves.  For SMEs, the biggest risk is not necessarily failing to buy cyber security technology, but it is often buying the wrong technology, deploying it incorrectly, and assuming the business is protected when it isn’t.

For a small UK business, cyber security decisions need to balance risk, cost, complexity and available expertise. A product may have excellent capabilities, but if it is poorly configured, inadequately monitored or not maintained, it can create a false sense of security.

What are the main issues SMEs should be concerned about?

Buying technology without understanding the risks

SMEs may purchase antivirus, endpoint detection, email security or backup solutions because they are familiar brands or recommended by a supplier or their IT support company, rather than because they address their specific risks.  This often leaves them with the impact that money is spend, without addressing many of the vulnerabilities they face.

Overlapping products and security gaps

Different tools may offer similar features while leaving other areas uncovered. Endpoint protection, email security, identity protection and cloud monitoring need to work together.  The impact is again expenditure leaving blind spots in protection.

Poor deployment and configuration

Configuration of these technologies can be complex, requiring an understanding of the risks being faced. Security features may be disabled, policies may be too permissive, devices may be excluded, or alerts may not be configured correctly.  A product appears to be installed but fails to prevent or detect an attack effectively.

Who monitors and responds to alerts?

It is rare to find an SME that has the ability to monitor and respond to alerts.  This is becoming more and more of an issue, especially now that Cyber Essentials requires a board level person to certify that the organisation will maintain the standard throughout the 12-month life of the certification.  How are they going to do that without some form of monitoring.  Detection software can generate alerts around the clock, but someone still needs to investigate them, establish whether they are genuine threats and take appropriate action.  Attacks can be going on whilst staff continue with normal business activities.

Hidden costs and ongoing commitments

Licence fees are only part of the total cost. Implementation, integration, staff training, ongoing monitoring, support and renewals can add considerably to the expense, with the danger that a solution becomes unaffordable, or becomes underused and neglected.

No clear evidence that protection is working

Purchasing a product does not prove that security controls are effective. SMEs need to verify coverage, test important controls and review whether identified weaknesses have been addressed.  You may believe the business is secure without having any evidence to support that belief.

Other important purchasing and deployment risks

The particular challenge for small businesses

SMEs often face three constraints simultaneously:

• Limited budgets: They cannot buy every available security product.
  • Limited technical expertise: They may not have an in-house security specialist to configure and maintain their tools.
  • Limited time: Directors and employees have other responsibilities, so security tasks can be neglected.

This means the objective should not be to accumulate the largest number of security products. It should be to achieve an appropriate level of protection and maintain it consistently.

For example, a business with 15 employees using Microsoft 365 might already have some useful security features included in its subscriptions. Before purchasing additional products, it should establish which features are licensed, enabled, correctly configured and actively monitored. It may then need additional endpoint protection, managed detection and response (MDR), backup or other controls to address the remaining risks.

A practical purchasing and deployment framework

• Assess the risks first

Identify important business systems, sensitive data, likely threats and the consequences of an incident. A Cyber Maturity Assessment (CMA) can provide a structured baseline.

• Define the required outcomes

Specify what the business needs to prevent, detect, respond to and recover from. Avoid selecting a product before defining the problem.

• Evaluate the whole cost

Compare licence costs, implementation, configuration, monitoring, support, training and renewal costs over the expected life of the solution.

• Verify deployment

Confirm that every relevant device, account and service is covered; settings are appropriate; and alerts reach someone who can act on them.

• Test effectiveness

Check security configurations, simulate appropriate scenarios, test backups and recovery, and confirm that alerts and escalation procedures work.

• Monitor and review continuously

Review alerts, patching, access rights, device coverage and outstanding risks. Reassess the controls when the business or its technology changes.

Questions directors should ask before approving a purchase

SME cyber security buying checklist

• Have we identified the business risks this product is intended to address?
• Do we know what security capabilities we already own?
• Is the product compatible with our existing systems?
• Who is responsible for installation, configuration and maintenance?
• Who monitors alerts and responds outside normal working hours?
• Have we confirmed all relevant devices, users and cloud services are covered?
• Have we tested detection, incident response and backup recovery?
• Can we demonstrate that relevant security controls are operating effectively?
• Is the total ongoing cost affordable, including support and renewals?
• Will the supplier provide clear reporting and evidence of protection?

How can a Cyber Maturity Assessment and MDR help an SME:

• Understand its current security posture before committing to additional expenditure.
• Identify gaps and prioritise improvements according to risk, cost and effort.
• Make better use of existing licences and technology.
• Establish whether MDR is justified and which level of service is appropriate.
• Develop a practical improvement roadmap and evidence progress towards Cyber Essentials.

MDR can then be used to address the ongoing challenge of monitoring and responding to threats, rather than leaving the SME dependent on software alone.

Finally

Our message to SME owners and directors is:

Don’t just ask, “What cyber security technology should we buy?” Ask, “What risks are we trying to reduce, how will we know the controls work, and who will make sure they continue to work?”