What does a cybersecurity company do for a small business?

Three kinds of provider

There’s overlap, and some firms do all three. What matters is that every part of your business that can be attacked is someone’s named job.

• IT companies (managed service providers) look after computers, phones, printers, the office network and software licenses. Many include antivirus and backups.
• Managed security service providers watch systems for attacks around the clock, often with security software on every computer and a team that responds to alerts.
• Cybersecurity firms like us focus on what faces the internet and on testing: websites, domains, DNS, email authentication, forms that collect customer data, monitoring, security assessments, penetration tests and incident response.

Where the gaps usually are

In our October audits of Grand Strand businesses, 29 of 33 domains let anyone send email as the business, and 30 of 33 sites were missing standard browser protections. Those gaps sit between the IT company and the web designer.

• The domain and DNS, which the IT company doesn’t manage and the web designer set up once.
• Email authentication (DMARC), which sits in DNS, so nobody owns it.
• The website, which the web designer built and nobody updates.
• Forms collecting customer data, which nobody thinks of as a security system.

Which do you need?

• Office computers and network: an IT company.
• Around-the-clock threat monitoring on computers and servers: a managed security provider, often through your IT company.
• Website, domain, email and testing: a cybersecurity firm that does those, which is what we do.