Mastercard is building cyber protection into business services. What does that tell SMEs?
Cyber security is starting to become less of an optional extra and that can only be a good thing.
Mastercard has launched a new package of services aimed at small and medium-sized businesses which includes cyber security protection alongside the usual financial and business benefits.
What caught my attention wasn’t really the product – it was the research behind it.
Mastercard’s global Dreamonomics research surveyed more than 6,000 SMEs across 18 countries. It found that 71% see protection from cyber threats as a priority, yet only 37% currently use cyber security tools.
That’s quite a gap.
Businesses know cyber security matters, but turning that concern into practical protection is where things often stall.
Small businesses don’t need another complicated dashboard
I’ve worked with small organisations for years and the problem usually isn’t that the owner doesn’t care about cyber security. It’s that they’re already doing everything else.
They’re dealing with customers.
Chasing invoices.
Paying suppliers.
Managing staff.
Sorting the accounts.
Fixing whatever has broken that morning.
Nobody started a plumbing firm, accountancy practice, care business or engineering company because they wanted to become an expert in endpoint detection, identity security or email authentication.
That’s why one comment from Mastercard’s Mark Barnett particularly stood out.
He argues that providers need to reduce complexity and make protection easier to adopt. Mastercard’s approach includes tools such as My Cyber Risk, which assesses an organisation’s external cyber exposure and highlights potential vulnerabilities.
I think the principle is right. Security should increasingly be built into the technology and services businesses already use.
But there’s an important distinction.
Built-in protection doesn’t mean everything is protected
A cyber risk assessment can identify useful things. It may spot an exposed service, an internet-facing vulnerability or something about your external footprint that deserves attention. But that doesn’t necessarily tell you everything happening inside your business.
It doesn’t know whether:
Dave left six months ago but still has an account.
Everyone has local administrator rights.
Microsoft 365 MFA hasn’t been configured properly.
Somebody clicked a phishing link yesterday.
Your laptops haven’t installed important security updates.
Your backup exists but has never actually been restored.
An attacker has stolen a session token and bypassed the password altogether.
Your accounts team has just received a convincing email asking them to change a supplier’s bank details.
Cyber security works in layers. One useful tool doesn’t make the other layers unnecessary. The same applies when somebody tells me:
“We’ve got Microsoft Defender.”
“Our IT company sorts that.”
“We’ve got cyber insurance.”
“Everything is backed up.”
Those things may all be true, but the next question is: what exactly is covered?
The UK figures show why this matters
This isn’t just an enterprise problem. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 42% of micro businesses and 46% of small businesses had identified some form of cyber security breach or attack during the previous 12 months.
There’s another interesting finding. Small businesses actually went backwards in some areas.
The proportion undertaking cyber security risk assessments fell from 48% to 41%. Businesses with a formal cyber security policy fell from 59% to 52%, while those with a business continuity plan covering cyber security dropped from 53% to 44%.
At the same time, more micro businesses are turning to external cyber security providers.
A ten-person company doesn’t need a full-time security department, but it does need somebody making sure the important things aren’t falling between the cracks.
So what should a small business actually have?
It doesn’t have to start with an expensive security project.
Start with the basics.
Protect identities.
Use MFA wherever possible, remove unused accounts and limit administrator access.
Keep things patched.
Laptops, servers, browsers, applications, firewalls and other devices all need security updates.
Protect email.
For many small businesses, email remains the front door to invoices, customer information, Microsoft 365 and password resets.
Protect the devices.
Modern endpoint protection can do considerably more than traditional antivirus, particularly when it is backed by people monitoring suspicious activity.
Back up important data.
Don’t stop at seeing a green tick in a dashboard. Make sure data can actually be restored.
Have somebody watching.
Security products generate alerts. Somebody needs to know which ones matter and what to do about them.
Have a plan.
If something goes wrong at 9am on Monday morning, who gets called? What gets disconnected? How do you continue trading?
For many SMEs, Cyber Essentials is also a very sensible framework for getting these fundamentals in place.
Where Black Swan Cyber can help
This is exactly the gap we try to fill at Black Swan Cyber Security Solutions.
We’re not trying to turn small business owners into cyber security experts. We’re there so they don’t have to become one.
Depending on the organisation, that might mean helping with:
Cyber Essentials readiness and remediation
managed endpoint protection
automated patch management
Microsoft 365 and identity protection
email security
managed detection and response
Microsoft 365, endpoint and server backups
security awareness
vulnerability reviews
fractional IT Director or vCISO support
Sometimes the answer is a security product. Sometimes it is changing a setting. Sometimes it is removing an old account nobody realised was still there. Sometimes it is simply having somebody independent look across the whole setup and ask who’s checking this?
The bigger message from Mastercard
I think Mastercard’s announcement is significant for a reason that goes beyond Mastercard. Cyber security is gradually becoming part of the plumbing of running a business.
Banks, payment providers, software companies, insurers and technology providers are all starting to embed more security into what they offer. That’s progress, but SMEs shouldn’t mistake having some security included for having the business secured.
Use the tools available to you. Then work out what they cover, what they don’t cover and who is responsible for everything in between.
Because good cyber security for a small business shouldn’t mean buying everything. It means putting sensible protection around the things that would really hurt if they stopped working.
Need a second pair of eyes?
Black Swan Cyber Security Solutions helps small and micro businesses across Derbyshire, South Yorkshire and North Notts put practical, proportionate cyber security in place without turning it into another full-time job.
We can review what you’ve already got, identify the gaps and help you decide what actually needs fixing. No scare stories. No unnecessary complexity. Just sensible cyber security for small organisations.
