SMB Cybersecurity
Most small and midsize businesses know where their weak spots are. The hard part is finding the time and people to fix them.
That’s the main takeaway from a new survey of 361 small and midsize business (SMB) leaders by cybersecurity software company CyberFox, reported by Channel Dive on November 3. Nearly two-thirds of respondents said limited staffing has left important security risks unaddressed. Almost half said their most significant known security gap stayed open for at least six months.
Security work is growing faster than IT teams
Three-quarters of respondents said security responsibilities have grown faster than IT headcount over the past three years. The strain shows most on smaller teams. Nearly four in five respondents at companies with IT teams under 15 people said they had bought a cybersecurity tool their team couldn’t fully deploy or manage.
AI is adding to the load. One in five respondents said AI-related projects had delayed or pushed back a planned cybersecurity project. Among IT leaders specifically, that rose to two in five.
“A lot of these smaller IT teams are overworked and under-budgeted,” CyberFox CTO Andrew Bensinger told Channel Dive. “They can’t take on everything that’s on their plate, and now they’re asked to be a security expert.”
More businesses are bringing in a partner
The survey also shows how many SMBs are handling this. Nearly two-thirds said they use a managed service provider or managed security provider for at least one IT or cybersecurity function. Companies with fewer than 15 internal IT staff were almost twice as likely to use an outside provider. Among SMBs that work with a provider, more than two-thirds said it frequently helped them put in place a security control their own team didn’t have the time or expertise to handle.
What this means for your business
A known gap that stays open is one of the easiest ways in for attackers. For single-office businesses and multi-location brands alike, a few habits help close gaps faster:
- Keep a short, ranked list of known security issues, and give each one an owner and a target date.
- Before buying a new security tool, make sure someone has the time and skills to set it up and manage it.
- Keep AI projects from quietly bumping security work off the schedule.
- Look at the basics first, like updated software, multi-factor authentication and tested backups.
For the very smallest businesses, the National Institute of Standards and Technology (NIST) just released a free, plain-language guide for solo business owners. It walks through cybersecurity basics using the NIST Cybersecurity Framework.
At Vexitey, VEXsecure and our Managed IT services help small businesses and multi-location brands turn known risks into finished fixes. If your security to-do list keeps growing, contact us to talk about where to start.