A contact recently recommended Greg van der Gaast’s book I Call Bullshit. It challenges quite a few accepted ideas within cyber security and one of the themes particularly resonated with me: the relationship between cyber security and the wider business.
It got me thinking about something I’ve struggled with running a cyber security business myself.
How do you persuade a small business to spend money preventing something that might never happen?
Cyber security professionals often assume the problem is that business owners don’t understand the risk.
I’m increasingly wondering whether that’s unfair and perhaps they understand business risk perfectly well. Perhaps we’re just not very good at explaining what we’re selling.
Cyber security is competing with things businesses can see
Put yourself in the position of someone running a ten-person business.
Money is going out every month on wages, National Insurance, tax, insurance, rent, energy, vehicles, equipment, software, marketing and probably another dozen things.
Then somebody like me comes along talking about cyber security.
The traditional proposition effectively becomes: Spend more money now and we’ll reduce the likelihood of something bad happening at some unknown point in the future.
That’s not a particularly attractive proposition.
The business owner can see what a new van does.
They can see what a new member of staff does.
They can hopefully see what their marketing does.
Cyber security is different.
When it’s working properly, quite often nothing happens.
You pay for backup and don’t lose anything.
You pay for email security and don’t see the malicious emails it blocked.
You pay somebody to monitor your systems and nobody compromises them.
You enable MFA and nobody steals your account.
Success can look remarkably similar to having spent money on nothing.
Perhaps that’s why we need to stop selling cyber security products and start talking about business outcomes.
Nobody wakes up wanting to buy MFA
I’ve never met a business owner whose ambition for the year was to sort multi-factor authentication.
Or buy EDR.
Or DNS filtering.
Or immutable backup.
These things matter enormously to people like me because they’re controls we use to reduce particular risks.
But they’re not the outcome the customer actually wants. The customer wants their business to keep working. So perhaps we need to translate what we’re selling.
MFA isn’t really about MFA
For many small businesses, Microsoft 365 has quietly become one of their most important business systems.
Email, contacts, files, SharePoint, OneDrive and Teams can all sit behind one identity.
So I’m not really asking you to buy MFA.
I’m asking: What would happen if somebody else gained access to the Microsoft 365 account you use to run your business?
MFA is simply one of the controls that helps prevent that.
Backup isn’t really about backup
Buying backup storage isn’t particularly exciting either.
The value becomes obvious when we ask a different question:
If your files disappeared this afternoon, how quickly could you carry on working?
That’s what you’re buying. Not gigabytes of storage. Recovery.
Managed detection isn’t really about another security dashboard
Small organisations generally don’t need more alerts.
They have enough things demanding their attention already.
The real question is: If somebody started doing something suspicious inside your network at 2am on Sunday, who would notice?
That’s the value of managed detection and response. Somebody is looking when you aren’t.
A password manager isn’t really about passwords
It’s about giving staff a practical way to use strong, unique credentials without expecting them to remember dozens of passwords.
It’s also about reducing password reuse, insecure spreadsheets, notes and unnecessary password resets.
Security that makes people’s working lives harder will eventually be worked around.
Good security should make the secure option easier.
Patch management isn’t just a cyber security control
We talk about vulnerabilities because they’re important. But keeping software and operating systems properly updated is also basic IT hygiene.
You’re reducing exposure to known vulnerabilities while keeping devices maintained and supported.
Again, the objective isn’t “patch management”. It’s keeping the technology the business depends upon healthy.
Cyber Essentials isn’t just a certificate
For some organisations, Cyber Essentials is becoming part of doing business.
Customers may ask about it.
Supply chains may require it.
Tender opportunities may depend upon it.
Insurers may be interested in the controls behind it.
So the question isn’t necessarily: “Do you want to spend money on a cyber security certification?”
It might be: “Could demonstrating good cyber security help you win or retain business?”
That’s a very different conversation.
Security has to compete for limited money
One of the other books I’ve been reading recently, The Psychology of Cybersecurity by Sarah Y. Zheng, describes what it calls a “cyber-reality gap”.
In simple terms, organisations have a level of cyber risk, a level of risk they’re comfortable accepting and a limited amount of money available to reduce that risk.
Those three things don’t always line up and I think that’s particularly relevant to small businesses.
Telling a business owner they “need” every security product available isn’t particularly helpful if the resulting bill is unaffordable.
Perfect cyber security isn’t realistic.
There will always be risk.
The sensible conversation is: What could seriously disrupt this business?
What protections already exist?
Where are the biggest gaps?
What can the business realistically afford?
Where will spending that money make the biggest difference?
Sometimes that means implementing several controls.
Sometimes it means fixing one glaring weakness first and improving things gradually.
I’d much rather help a small business make three meaningful improvements it can afford than present it with an enormous security stack it will never buy.
We also need to answer “Why should I bother?”
Another book I’ve been reading, Cybersecurity ABCs by Jessica Barker, Adrian Davis and Bruce Hallas, makes a point that applies far beyond security culture.
If we want people elsewhere in an organisation to support security, we need to answer a basic question: “Why should I bother?”
Not why I think cyber security matters. Why should they care? That’s an important distinction.
The finance director might care about fraud and financial interruption.
The operations manager might care about systems being unavailable.
The managing director might care about customers and reputation.
Someone responsible for tenders might care about Cyber Essentials.
A school business manager might care about safeguarding, payroll and keeping critical systems running.
An IT manager might care about getting an alert at 2am and knowing somebody else is already investigating it.
Same cyber security. Different value.
Fear isn’t a particularly good long-term sales strategy
The cyber security industry hasn’t always helped itself here.
We can show businesses ransomware statistics.
We can tell them how much the average breach costs.
We can show them pictures of hooded hackers and eventually we can make almost anybody frightened enough to buy something.
I don’t think that’s a particularly good basis for a long-term relationship.
There are no guarantees in cyber security.
I can’t honestly tell a business: “Buy these products and you’ll never be breached.”
Nobody can.
What I can say is: We can make you harder to compromise.
We can improve the chances of spotting something quickly.
We can limit what an attacker can do.
We can improve your chances of recovering when something goes wrong.
That’s a much more realistic conversation. It’s also why I prefer talking about resilience rather than fear.
What does the business actually want?
Strip away all the cyber security terminology and I think the answer is remarkably simple.
Most small business owners want Monday morning to look like Monday morning.
They want people to turn up and work.
They want email working.
They want access to their files.
They want customers looked after.
They want invoices going out.
They want suppliers being paid.
They want their reputation intact and if something does go wrong, they want somebody who knows what to do and a realistic way of getting the business running again.
Cyber security supports all of those things, which leads me to something I’ve increasingly come to believe:
You’re not really selling cyber security. You’re selling the avoidance of expensive disruption.
That changes the conversation.
Backup isn’t a cost. It’s part of your recovery capability.
Managed detection isn’t another piece of software. It’s somebody watching when you’re not.
MFA isn’t an inconvenience. It’s another barrier between a criminal and the account running your business.
Cyber Essentials isn’t just compliance. It can be evidence that helps customers trust you and good cyber security isn’t about buying everything.
It’s about understanding what matters to your organisation and spending your limited budget where it will make the biggest difference.
Maybe businesses don’t need more cyber security jargon
They need somebody who understands that cyber security is only one of many things competing for their time and money.
Some organisations need sophisticated protection.
Others need to start with MFA, decent backups and getting their updates under control.
Both are valid, but the important thing is understanding the risk and making a conscious decision about it, rather than simply hoping nothing happens.
Perhaps, then, the challenge for people like me isn’t just convincing businesses to spend more on cyber security. It’s explaining what that investment actually buys them.
Because businesses don’t really buy MFA, EDR, ITDR, MDR, SAT or any of the other acronyms our industry loves. They buy the ability to keep operating and perhaps that’s how we should have been talking about cyber security all along.
Affiliate disclosure: Some links in this article are affiliate links. If you buy a book through one of these links, we may receive a small commission at no extra cost to you. We only link to books we have genuinely read or recommend.
