Most small and mid-sized organisations need four cybersecurity solutions and very little else: endpoint detection, tested backups, multi-factor authentication, and disciplined patching. Everything stacked on top is either a control for a risk you genuinely carry, or margin for the vendor. Knowing which is the whole skill.
Vendors sell platforms. Attackers exploit gaps. Those two things overlap far less than a sales deck suggests.
The four controls that stop most real incidents
Endpoint detection and response replaced traditional antivirus for a reason. It watches behaviour instead of matching known file signatures, which is what catches script-based and fileless intrusions.
Multi-factor authentication on email and remote access closes the credential route. Stolen passwords stay useful for years, and a second factor makes most of them worthless.
Backups count only if you have restored from them. Test a restore on a schedule and keep one copy offline or immutable, because ransomware crews delete every backup they can reach.
Patching is unglamorous and it still does the heavy lifting. A large share of intrusions walk through a vulnerability that already had a published fix.
What gets upsold before you are ready for it
A SIEM is the classic case. It ingests logs from everything, correlates events, then produces alerts nobody reads because no one is rostered to read them. A SIEM without an analyst behind it is an expensive log archive.
Zero trust is architecture, not a product. Any supplier selling it as a single line item is selling you one component and calling it the whole model.
Full cloud security platforms make sense once your cloud estate is genuinely complex. Before you commit, read how CSPM, CNAPP and CWPP tools differ, because they solve separate problems and buying all three at once is common and usually wasteful.
Threat intelligence feeds are the other frequent add-on. Curated indicators help teams that actively hunt. They do nothing for a team of two who cannot act on them.
How to decide without a security team
Start from your own asset list rather than a vendor feature matrix. Ask which systems, if unavailable for a week, would stop you invoicing customers. Those get budget first.
Then put one question to every supplier: what specific attack does this stop, and how would we know it worked? A control you cannot verify is not really a control. The same logic drives risk-based vulnerability management, which ranks fixes by real exploitability instead of raw CVE counts.
Insist on a trial with your own data. Two weeks inside your environment tells you more than any reference customer ever will.
Where outside expertise genuinely pays
Testing is the one area where buying skill beats building it. An automated scan and a human-led test produce very different outputs, and the gap between vulnerability assessment and penetration testing decides whether you get a findings list or an actual attack narrative you can act on.
Managed detection and response earns its fee when you need round-the-clock cover and cannot staff nights. Judge providers on contracted response times and on whether they contain a threat or simply email you about it.
Questions businesses ask before signing
How much should a business spend on cybersecurity solutions?
There is no honest universal percentage. Price the four core controls first, then add spend only where a specific asset justifies it. If a quote cannot be traced to something on your asset list, it is premature.
Does a small business need a SIEM?
Rarely, at least at first. Without someone to triage alerts daily, the logs pile up unread. Managed detection with human triage is usually the better buy at that size.
Is endpoint protection enough on its own?
No. It handles the device layer well, but it cannot stop a valid login from a stolen password or recover data after encryption. Pair it with MFA and tested backups.
