Why SMBs Continue to Drive Growth in Managed Security Demand

by Charles Ho
SonicWall Outside Regional Sales Director

Large enterprises, like Facebook and Under Armor, continue to spend millions of dollars protecting their businesses from cyberattacks but still end up in the headlines — and not in a good way.

This hasn’t changed much since the first mega-breaches in 2013 and 2014. While they’ve incurred substantial fines or have lost significant reputation, most of these large enterprises have stayed in business.

This is not the case when we look at small- and medium-sized businesses (SMB), where a staggering 60 percent fail within six months of a cyberattack. When you take into consideration that 32 percent of SMBs were hit by at least one malware attack, this means one in five small businesses are closing down.

The disproportion will continue to grow as the gap in security protection between large enterprises and SMBs widens.

Governments around the world have already started taking action, from the recently signed NIST Small Business Cybersecurity Act in the U.S., to the Notifiable Data Breaches (NDB) scheme in Australia, to GDPR in the EU. However, the responsibility of staying protected ultimately sits with these SMBs.

SMB Cyber Security Requires Measured Strategy, Self-Awareness

SMBs must make a decision of protecting themselves or outsourcing the problem to a managed security service provider (MSSP). The solution is much more complex than simply installing antivirus or a firewall, so I’m going to oversimplify and break it into two pieces:

• Procuring and implementing security technology and controls
• Operating the technology and responding to cyberattacks that bypass security controls

The first component, the cost to the customer, is roughly the same whether they implement and manage cyber security themselves or outsource it to a partner. Although, a partner can make the process smoother and the technology easier to consume.

But let’s take a closer look at the second piece, which is the amount of effort needed for an average customer to respond to today’s threat landscape. First, let’s make some assumptions around the environment, both internally and externally:

• The technology you’ve implemented is 100 percent effective against known cyber attacks
• The combination of different security technology and controls gives you 99.9 percent effectiveness against unknown attacks. (While many may claim, there is no silver bullet in security.)
• Last year, more than 350,000 new variants of malware were found daily
• You’re exposed to 1 percent of threats seen globally – unlike advanced persistent threats (APT), the majority of threats like ransomware and cryptojacking take a “spray-and-pray” approach.

Quantifying SMB Cyber Security Effectiveness

Based on these assumptions, each SMB, on average, faces a handful of cyberattacks not blocked by any layer of protection. These attacks, ultimately, need to be investigated and mitigated via human interaction.

Depending on the scope of these incidents, it can take a matter of hours or days to remediate the problem. However, let’s assume each incident takes four hours for an analyst to resolve. This means that each SMB requires more than 1.5 dedicated headcount — to deal with this problem each day.

Here lies the fundamental problem to Scenario 1 listed above. SMBs can neither afford to hire dedicated security personnel, nor is there sufficient expertise in the workforce to fill that gap.

The result? A dire need for managed security services (MSS), especially for SMBs. If you’re already an MSP and have a set of loyal customers, extending your portfolio to include cyber security is simply a no-brainer. Leverage your existing managed service infrastructure and expertise to take advantage of one of the fastest-growing market opportunities: managed security.

_{This story originally appeared on MSSP Alert and was republished with permission.}

Guest Author