If you've ever
met me in person, I probably don't look like what you'd expect from the
president of an IT company.
I'm a big, bald
guy with a lot of tattoos. I've been told more than once that I look more like
the bouncer at a bar than the guy you'd call to talk about cybersecurity.
I'm actually
okay with that.
Because the
more I think about it, a good bouncer and good cybersecurity have a lot in
common.
You don't hire
a bouncer because you want him breaking up fights every night. Ideally, very
little happens at all. He's watching who's coming through the door, paying
attention to what's happening around him, and stopping problems before they
turn into something much bigger.
Cybersecurity
works much the same way.
And both have
another thing in common: security can seem unnecessarily expensive right up
until the moment you need it.
As a business
owner myself, I understand why.
Every dollar in
a business has somewhere it could go. Payroll. Benefits. Marketing. New
equipment. Hiring another employee. Expanding the office. Improving the
customer experience.
Cybersecurity
has to compete with all of those things, and it has one major disadvantage.
When
cybersecurity works, nothing happens.
There's no
shiny new machine on the shop floor. There's no new salesperson generating
revenue. There's not necessarily a line on your financial statement showing
what you received for the money.
The desired
outcome is remarkably boring.
Your employees
come to work. They log into their computers. Your systems operate. Your
customers' information stays private. Everyone goes home.
That's success.
Unfortunately,
that can also make cybersecurity an easy place to question the budget.
Research cited
by IBM found cybersecurity budgets represent about 5.7% of overall IT budgets.
At the same time, ISACA's 2025 State of Cybersecurity research found that 53%
of cybersecurity professionals believed their organizations were underfunded.
Only 41% expected their cybersecurity budgets to increase.
Meanwhile,
small and midsized businesses are far from immune to cybercrime.
A 2025
Mastercard survey of more than 5,000 small and midsized business owners found
that 46% had experienced a cyberattack against their current business.
Even more
concerning, nearly one in five businesses that experienced an attack
subsequently filed for bankruptcy or closed.
Think about
that for a moment.
For a small
business, a serious cybersecurity incident isn't necessarily an inconvenience
that the IT department handles while everyone else continues working. It can
become an event that threatens the business itself.
Yet something
interesting happens after a business experiences a serious cybersecurity
incident.
The budget
conversation changes.
Things that
seemed expensive before suddenly seem incredibly reasonable.
Multi-factor
authentication? Absolutely.
Better backups?
When can we get them?
24/7 security
monitoring? Sign us up.
Employee
cybersecurity training? Let's schedule it.
Cyber
insurance? Call the broker.
The irony is
that almost all of those things were available before the incident.
It's a little
like owning a bar and deciding a bouncer is too expensive. Maybe you decide you
don't need cameras either. Nothing bad has happened before, so why spend the
money?
Then one night
somebody walks through the front door, starts a fight, destroys half the place
and puts you out of business for a week.
Nobody stands
in the wreckage afterward and congratulates themselves for saving money on
security.
That's the
strange economics of cybersecurity.
Before an
incident, cybersecurity is judged against what it costs.
After an
incident, it's judged against what the incident costs.
And those are
very different numbers.
The answer
isn't simply to throw more money at cybersecurity. Spending more doesn't
automatically make a business secure. Good security requires the right
combination of technology, policies, employee education, backups, monitoring,
planning and people.
The important
part is understanding your actual risk and deciding what level of risk you're
willing to accept.
No
cybersecurity strategy can guarantee that a business will never be attacked.
That's no more realistic than a bouncer guaranteeing that nobody will ever
cause trouble inside a bar.
The goal is to
make it harder to get through the door, recognize trouble quickly when someone
does, and have a plan for what happens next.
So here's a
question I think every business owner should ask:
If you knew
your company was going to experience a cyberattack six months from now, what
would you change today?
Would you
improve your backups? Require multi-factor authentication everywhere? Train
your employees? Replace outdated systems? Increase monitoring? Spend more on
cybersecurity?
Whatever your
answers are, there's one more question worth asking.
Why wait until
after the fight to hire the bouncer?
