Small businesses need security they can actually run

David Spark and Steve Zalewski begin with a familiar mismatch. Smaller organisations hold customer data, keep suppliers running, and sometimes have trusted access into much larger companies. Yet the security products offered to them are often designed around enterprise budgets and dedicated teams. A small supplier’s limited headcount does not make its access or impact small.

Guest Mark Stockley argues that a small business is not simply a scaled-down enterprise. Its constraints are different: one person may handle IT among several other jobs, the devices may be older, and a product that needs weeks of configuration may never be properly used. The point that stayed with me was how easily we mistake buying a control for being able to operate it.

The discussion moves through multifactor authentication, knowing what assets exist, patching, network controls, and basic awareness. None of these is a magic shopping list. Each needs someone who can see when it fails and decide what to do next. Stockley makes the case for managed detection and response as a way to provide that capacity when a small team cannot staff a round-the-clock operation.

That is a useful argument, but it is also a sponsored episode: Stockley works for ThreatDown, the sponsor. I would not turn the conversation into a blanket recommendation to buy MDR. The transferable idea is to match the control to the organisation’s ability to maintain it, whether that capacity is internal or provided by a service. Secure defaults help because they reduce the work required before a control starts doing its job.

1. 1

   Name the handful of systems that matter most. Include customer-facing services, identity, backups, and any privileged connection into a partner or customer environment. This makes the first security decisions concrete.

2. 2

   Check the baseline in use, not just on paper. Confirm MFA coverage, device inventory, update ownership, and whether alerts reach someone who can act. Note what is still at the product default.

3. 3

   Plan for the hours nobody is watching. Decide who can investigate and contain a suspicious event after hours. If a provider fills that gap, test the handoff, authority, and response expectations before relying on it.

This review draws on the CISO Series episode and published transcript from 8 October 2026. It is an original interpretation for defenders, not a transcript or an endorsement of the sponsor’s service. The suggested exercise is ours.