Cybersecurity for smaller businesses often suffers by being either underpowered or too complex. This tension can be challenging to resolve for small IT teams that may lack an in-house cyber expert. Understanding the problem is not the same as understanding where the solution lies.
Effective SMB protection demands that vendors lead their customers through a clear onboarding process – and offer practical and transparent guidance during incident response engagements.
Without trusted partnerships like this, SMBs may struggle to optimize the way they use security products and services. They may find it difficult to explain incidents to insurers and regulators. And they may fail to learn from threat events in a way that can help to build long-term resilience.
Complexity is everywhere
These challenges are important not just for SMBs themselves to overcome. As they make up over 99% of all private sector companies in Europe and North America, small and mid-sized firms are the backbone of most economies and comprise the supply chain of larger organizations. That puts them directly in the firing line of threat actors looking for weaknesses to probe, en route to client data or network access. Production outages at critical points in supply chains can have potentially catastrophic knock-on effects.
Fortunately, SMB IT and security leaders get it and increasingly consider cybersecurity very or extremely important. That may be because many organizations have suffered at least one cyber incident in the past 12 months alone. These events tend to focus the mind, particularly when they’re significant or critical and lead to system downtime, data breaches, ransomware, email compromise, and more.
But awareness and action are two different things. SMBs know they need effective protection, but their efforts to achieve this often hit a familiar roadblock: complexity. Many often say that even keeping up with the latest trends and threats is a major challenge. The speed with which the threat landscape changes is just one of many contributing factors.
At a basic level, security best practices remain broadly the same, as do the types of threat that businesses can expect. Phishing, vulnerability exploitation, infostealers, compromised credentials, and business email compromise (BEC) are still among the most popular avenues for threat actors. AI merely amplifies and accelerates. However, peel back the onion a layer or two and threat intelligence can become intimidatingly complex.
Understanding what a genuine threat to the organization is and what not to worry about is often beyond the capability of a small IT security team. They might have neither the time nor subject matter expertise to make an effective assessment. Security often suffers as a result, becoming reactive and piecemeal.
Vendors can make life harder
The cybersecurity market can compound these challenges. The sheer variety of solutions and services on offer is staggering. It’s a global market worth an estimated $248 billion, rising potentially to $699 billion by 2034. This can make it difficult to compare vendor offerings effectively, even if they’re nominally in the same category. And once purchased, some solutions can be challenging for less-skilled teams to configure and operate. Getting the right fit for your business is critical.
Over half (55%) of SMBs surveyed by ESET argue that the cybersecurity solutions market is confusing and complicated, while nearly a third (30%) say solution complexity is a major challenge. The language used by the industry can also be impenetrable. Around three-quarters (72%) want plain-language explanations. Many don’t know the meaning of widely used monikers like MDR, EDR and XDR.
The pathway to supervised support
Yet there is some clarity among this confusion. SMBs know that preventative security is important. But they also realize that in some circumstances threat actors will always get through those defenses. That’s why most businesses ESET speaks to want protection that goes beyond ‘antivirus’ (AV) and essential safeguards.
This extra layer of protection should function as advanced support for specialized threats, complementing in-house management of basic security controls. Basic solutions will block malicious executables, for example, but what about sophisticated threat actors living off the land using safe-looking tools? Or an AI-discovered zero-day exploit for which there is no signature? Detecting these threats is the power of services like MDR.
The challenge is that they don’t work out of the box. Their effectiveness depends on how well a provider’s people, processes, and technology are aligned with your environment. Coverage is essential, as gaps can mean potential blind spots that hackers can exploit. If any exist, they should be well documented and regularly reviewed as your IT environment continues to evolve.
Visibility must also extend to the tooling that you have in place. Every organization is different. That means specialist MDR teams must clarify at onboarding the specific IT setup of the client, so they can quickly spot if an unsanctioned tool (like remote monitoring software) appears, which may indicate malicious activity.
All of which makes onboarding and setup a vital first step in a successful MDR engagement.
What guided onboarding should include
Most SMBs want step-by-step guidance on setting up a new cybersecurity product or service. This will ensure it’s integrated seamlessly into day-to-day operations. But what should that onboarding include?
- A live onboarding session with a vendor expert provides a great opportunity to ask questions as you’re being onboarded. Technical documentation is useful to refer to in some circumstances. But it can easily become overwhelming for less-skilled IT professionals. That’s why a live on-to-one session is invaluable; helping you to fill in the gaps with plain English explanations and learn through doing, not reading.
- Activation of the environment ensures it’s all up and running and helps you get an early look and feel of what to expect.
- Configuration and readiness checks are critical to ensure the service is optimized to work with your environment. Activation is just the first step. Configuration gets it operational. These checks are important to do during guided onboarding as they may be challenging for a non-specialist team to perform on its own.
- Guidance on notification, reporting and communication is about helping you understand how alerts will come through and how reporting is handled. You’ll learn who gets the notifications on your side and what will be expected of them when they do. It’s vital to get this right in order to prevent communication gaps between your team members and between your team and the vendor.
- An all-in-one installer can help to streamline deployment across all relevant endpoints, minimizing the configuration workload, and reducing time and human error.
- Running through MDR operations, incident workflows and reporting is about understanding how your vendor partner investigates and communicates incidents, and how to interpret reports. It’s about setting expectations on what your responsibilities are once the provider has identified an incident. Few vendors will take care of the entire incident and remediation workflow so knowing what’s expected of your team is critically important.
- A final set of best practices and next-step suggestions will shape your understanding of how to maintain the service over time, as the IT environment and threat landscape change. Prioritizing what matters most once you’re up and running is useful for teams with few resources who are committed to continuous improvement.
Above all, remember that the engineer is there to guide you through the process, not do all the heavy lifting themself. It’s about giving you the know-how to make the partnership a success, and optimize your use of the product or service.
When done correctly, it should mean faster time to protection, a lower risk of misconfiguration, and improved confidence that you can get the most out of your investment.
Guidance during use
Once you’re up and running, a good vendor should guide you through the process of incident detection and response. That means helping you to understand:
- What happened: Explaining an incident in plain English. What kind of threat was detected. Which IT systems were affected. How the adversary gained initial access. Whether data was compromised or stolen. And what remains unclear.
- Why it matters: Your vendor should help by translating technical into business risks. That will help you understand what the implications are for the organization, rather than thinking solely in IT terms. For example, a vulnerability exploitation may have enabled access to a customer database, which could raise the prospect of data loss and a GDPR investigation.
- What the provider did: Your security partner should detail exactly what steps it took to investigate and contain the threat, such as resetting passwords or isolating accounts. And what has yet to be done.
- What happens next: This is the most important part of the guidance. Your provider should provide actionable next steps, ideally in order of importance. It could include patching an exploited system, enabling MFA, restoring data from backups, etc. These recommendations should be clear, including who is responsible and ideal timelines. Because when intrusions happen, minutes matter.
They should also contain supporting evidence such as logs that can be used to share with auditors, regulators and insurers if required. And to inform any customer outreach or business continuity efforts (such as restarting systems) that may be required. Evidence is also essential to minimize the chances of a similar incident occurring again. Resilience is all about learning the lessons of each intrusion to close off potential pathways for future threats.
Transparency is critical
If SMBs don’t receive this kind of clarity and detail during live incidents, there’s a risk that they may mistakenly believe malicious activity has been remediated, when in fact there is work left to do to contain and resolve the issue. That can allow the blast radius of an attack to spread, causing more damage.
Customers, regulators and other stakeholders might also remain in the dark, creating extra reputational and financial risk. And the organization itself will not have the forensic knowledge to hand to improve cyber resilience going forward.
Fundamentally, if you’re unable to determine what actions your provider took, you can’t calculate whether their service is worth the money you’re paying for it.
The value of human relationships
SMBs understand the value of cybersecurity. And they know that the threat landscape is becoming more volatile, potentially imperilling their business. But those without sufficient expertise are frustrated by the “known unknowns” that prevent them from understanding how the latest threats and trends affect their organization.
This is where security vendors must step up. They are trusted by more SMBs than any other entity – including internal staff, industry peers, and governments – as a trusted source of cybersecurity guidance.
SMBs don’t want to hand over all control for threat protection. They want to be empowered by trusted partners to keep their business more secure. At the center of this dynamic sit human relationships – and we know that SMBs value access to a human expert.
The key for vendors is to ensure these experts are available at onboarding, to guide SMBs through configuration, activation and setup. And that they’re on hand during incident response, to explain what happened, why it matters, what steps have been taken, and what there is left to do. It’s the kind of supervised protection that could turn cybersecurity from a cost of doing business into a true growth enabler for SMBs.