Undefended small firmsSmall firms face enterprise attacks without a security team
The tooling that would protect a small firm assumes somebody to run it: a console to watch, alerts to triage, a policy to maintain. A twelve-person company has none of those, and a serious incident can threaten the business itself. What is missing is not awareness (owners know) but anything that works without an operator.
Owner-managed firms and their one technical person · the larger customers whose supply chain runs through them · insurers pricing cyber cover
Why now
An ENISA survey of small and medium enterprises, carried out during the pandemic, found that around nine in ten expected serious harm to their business within a week of a cyber incident and that over half believed it would likely end the business, against a backdrop of low security budgets and a lack of in-house cyber skills.
Why it matters
An existential risk to the firms that make up the overwhelming majority of businesses, where the binding constraint is operator time rather than money or intent. Security that needs nobody to watch it is a different product from the one being sold.
From public reporting
Framed from public reporting. Here is what it was drawn from, so the framing can be checked against it:
Support has been largely automated, and for routine questions that is an improvement. The unusual case is where it breaks: a bereavement, a billing error, a locked account, a situation the script has no branch for. The customer loops, rephrases, tries again, and eventually gives up, and the company never learns it happened, because a failed escape is rarely a metric anyone collects.
For whomCustomers in genuinely unusual situations · the few remaining human agents · support leaders flying blind
Loss happens at the handovers: field to packer, packer to distributor, distributor to shelf. Every party measures only its own side of each one. So each set of numbers looks defensible while the total is enormous, and the interventions that would work are precisely the ones nobody can see, because they sit between two businesses rather than inside one.
For whomGrowers and packers · distributors and independent retailers · redistribution charities working the same corridors
Caring for an ageing parent means medications, appointments, home visits, bills and forms, shared between siblings in different cities and often different countries. It runs on a group chat, a shared folder and whoever remembers. Things fall through, one person quietly carries most of it, and the professionals involved each see a fragment of a picture nobody holds whole.
For whomAdult children caring for parents · home-care workers · family doctors seeing only their slice
