In an era where digital connectivity is the lifeblood of commerce, cybersecurity has transitioned from a back-office IT concern to a foundational business risk. For small and medium-sized businesses (SMBs), the stakes have never been higher. As cybercriminals leverage sophisticated tools and artificial intelligence (AI) to accelerate the discovery of vulnerabilities, the traditional "set it and forget it" approach to security is no longer sufficient.
To navigate this rapidly evolving landscape, I sat down with Tony Anscombe, Chief Security Evangelist at ESET. With three decades of experience in the technology and cybersecurity sectors, Anscombe offers a sobering perspective: for modern businesses, cybersecurity is not merely a technical hurdle—it is a matter of corporate survival.
The Shifting Landscape: Why Size is No Longer a Shield
A pervasive myth persists among small business owners: the belief that they are too insignificant to be targeted by cybercriminals. According to Anscombe, this mindset is not only outdated; it is dangerous.
"You’re probably critical to someone," Anscombe explains. Even if a small business does not hold vast amounts of consumer data, they often serve as essential links in the global supply chain. Cybercriminals are increasingly using SMBs as "conduits" to gain entry into larger, more lucrative enterprises.
The Ripple Effect of Compromise
Anscombe points to the well-documented incident involving Jaguar Land Rover (JLR) as a case study for modern supply chain risk. When a service provider within JLR’s network was compromised, the fallout was catastrophic, resulting in production shutdowns across multiple countries and costs estimated at nearly £2 billion.
Crucially, the incident affected 5,000 small businesses, leading to nearly 300,000 layoffs. This illustrates a critical lesson: a business does not need to be a global titan to be a target. If a small firm manufactures a single, essential component—the "magic screw" that holds a gearbox together—a cyberattack that takes that firm offline can effectively cripple a massive corporation’s production line. When a criminal realizes that a small business holds such influence, that business becomes a high-value target.
Chronology of a Crisis: The 24/7 Reality
One of the most profound challenges for small IT teams is the unrelenting nature of modern threats. Cybercriminals do not operate on a 9-to-5 schedule, nor do they respect time zones or public holidays.
The 2:00 AM Vulnerability
"Cybercriminals don’t come when you expect them to," says Anscombe. A weekend, particularly late on a Saturday or early Sunday morning, is prime time for attackers. If a business lacks 24/7 monitoring, a breach initiated on a Friday night could provide an attacker with an entire weekend to move laterally across a network, exfiltrate sensitive data, and establish persistence—all before the business owner arrives at the office on Monday morning.
The Patch Management Escalation
The pace of vulnerability discovery has also accelerated at an unprecedented rate, largely due to the integration of AI in offensive security. Anscombe notes a staggering trend in Microsoft’s "Patch Tuesday" releases. In the first three months of a recent year, Microsoft averaged 150 to 200 fixes per month. By September, that number surged to 974.
"AI is being used to find the vulnerabilities at a scale we’ve never seen," Anscombe observes. For a small team with limited resources, attempting to manually manage this volume of patches across all hardware and software components is, in his words, "virtually impossible."
The Medical Analogy: IT Expertise vs. Cybersecurity Specialization
A common point of confusion for SMB owners is the distinction between general IT support and specialized cybersecurity expertise. Anscombe utilizes a compelling medical analogy to clarify this:
"You have a family practitioner who is excellent at identifying the flu or recommending a check-up. But would you trust your family practitioner to perform neurosurgery?"
While a standard IT professional is vital for maintaining uptime and day-to-day operations, cybersecurity requires a different level of forensic skill. Modern attacks are rarely straightforward; they involve sophisticated techniques like lateral movement and credential theft that often bypass traditional antivirus software. Without a dedicated security analyst—the "specialist"—businesses often lack the capability to detect stealthy, persistent threats until the damage is already done.
The AI Paradox: Productivity vs. Risk
Artificial Intelligence represents a double-edged sword for the small business sector. While tools like Generative AI and automated agents promise massive gains in productivity, they simultaneously expand the attack surface.
Data Leakage and Intellectual Property
Anscombe raises a critical question for business owners: "Have you ever uploaded something to an LLM that could become company-sensitive?" Many employees, unaware of the risks, use public AI tools to rewrite emails or draft business documents. If that input contains proprietary data, it may be absorbed into the model’s training set, potentially resurfacing elsewhere.
The Rise of Malicious AI Agents
Beyond data leakage, there is the threat of "rogue" AI agents. Researchers have recently identified malicious code embedded in AI skills designed for tasks like automated PowerPoint creation. If a business blindly trusts the output of these agents, they risk introducing corrupted code or inaccurate information into their workflows.
"AI is a challenge because it’s unfolding at a pace where it’s difficult for anyone to keep up," Anscombe notes. The lack of visibility into how these tools function within a corporate network creates a blind spot that attackers are eager to exploit.
Implications: Building a Resilient Partnership
When internal resources are stretched thin, outsourcing to a Managed Service Provider (MSP) or a Managed Detection and Response (MDR) service becomes a necessity. However, Anscombe warns against the "hand-off" mentality.
The Partnership Model
"You’re not handing off; you’re partnering," he emphasizes. Even with a third-party security team, certain responsibilities must remain firmly within the business:
- Governance and Policy: The business must define its own security posture and compliance requirements.
- Employee Training: Cybersecurity awareness remains an internal cultural responsibility.
- Business Resilience Planning: The business must understand how to maintain operations during an incident, whether it is a cyberattack or a simple power outage.
- Crisis Management: While external experts handle the technical remediation, the business owner remains the "director of the play," coordinating the response and ensuring the firm can weather the storm.
What to Expect Post-Incident
If an MSP successfully detects a threat, the business owner should expect more than just an alert. A quality provider should offer a clear "evidence board"—a detailed breakdown of how the incident occurred, how it was resolved, and what the root cause was. This documentation is vital for preventing future recurrences and for insurance purposes.
Strategic Advice for Business Owners
For those currently vetting security vendors, Anscombe suggests looking for a partner who prioritizes understanding the specific nuances of your business.
"I’d look for the MSP that wants to understand my business," he says. A provider that takes the time to learn your operational technology, your compliance needs, and your specific industry risks is far more valuable than a "one-size-fits-all" solution. He also recommends including these partners in "tabletop exercises"—simulated crisis scenarios—to ensure that the team is ready to perform under pressure.
The Path Forward
Ultimately, the message for small business owners is one of empowerment rather than fear. Cybersecurity does not have to be an overwhelming, insurmountable wall. By combining the right technology with a strategic partnership, SMBs can build a defense-in-depth strategy that protects their assets and ensures their survival.
"Cybersecurity shouldn’t be a challenge that you’re scared of," Anscombe concludes. "There are the right experts out there, and with the right approach, staying safe is entirely achievable."
For businesses looking to begin this journey, evaluating their current resilience—asking, "Could I keep operating if a cyber incident occurred today?"—is the first, most important step. As the digital landscape continues to evolve, those who treat security as a fundamental business priority will be the ones that thrive.
