Walk into any small office and count the systems keeping it alive. Email and files in the cloud. A firewall from one vendor and antivirus from another. A backup subscription bought after a scare. A wireless router in a closet, running whatever firmware it shipped with. Each purchase solved the problem of its moment. Nobody designed the stack. It accumulated.
For years that was survivable. The trouble is structural now, and it shows up in three places: the seams between the tools, the scoreboard that measures them, and the silence that follows when they work.
The Seams Nobody Owns
Attackers stopped picking targets and started scanning for conditions. Automated probes hunt for the account that stayed active after a departure, the laptop two months behind on updates, the login with no second step. Those conditions live in the gaps between products, and no vendor on the list is responsible for the whole. The firewall company does not check whether the backup restores. The antivirus company does not notice the old admin account. Each tool does its job while the stack fails between them.
The Verizon 2025 Data Breach Investigations Report found that 88% of breaches at small businesses involve ransomware, more than double the rate at large companies. The attacks moved downmarket because the gaps live downmarket. And the meter runs fast once something breaks: Datto puts the average cost of downtime for a small or midsize business at $427 per minute.
The Scorekeeper Sells the Tools
When a small business does try to measure its security, the measuring stick usually belongs to a vendor. Microsoft Secure Score is the most widely used example: genuinely useful, and structurally conflicted, because the score rises as the business adopts more Microsoft products. Excellent controls from other vendors can leave the number flat. The grade and the upsell arrive in the same envelope.
A measurement worth managing to has one allegiance: does the control hold? Multi-factor login counts the same whichever vendor enforces it. A tested backup counts, whoever sold the software. An exposed service costs points, whatever logo is on the box. Scores like that are rare, because nobody profits from publishing one. They are also the only kind that can be trusted to track progress.
Protection You Can't Read
The deepest flaw in the tool-list model only shows up after everything is installed: when protection works, nothing happens. A blocked intrusion looks exactly like a quiet Tuesday. The invoice arrives every month; evidence never does. Owners are left to take protection on faith, and faith erodes at renewal time.
Meanwhile, the one outside party that demands evidence has raised the bar. Insurance carriers now ask about multi-factor login, protection on every device, and tested backups before they quote, and weak answers mean higher premiums, exclusions, or no quote at all. Carriers lead with multi-factor login because the evidence is lopsided: Microsoft measures that it blocks 99.9% of automated attacks on accounts. Hiscox puts the median annual cost of cyber incidents for a small business at roughly $8,300, and a bad year looks nothing like the median. The distance between "we pay for security tools" and "we can show our controls hold" is where a small business gets hurt twice: once by the incident, and again by the claim.
What to Demand Instead
The fix is not another tool. It is a different shape of agreement with whoever runs the technology. Four demands separate an outcome from a tool list.
A score with no allegiance. One number that grades the controls that matter, credits any vendor's control that works, and never changes its yardstick. If the score can be raised by buying more from the grader, it is a catalog, not a measurement.
A monthly report in plain language. What happened, as an incident ledger a non-technical owner can read. What changed, as gaps listed open, closing, and closed. And the score, moving or not. Protection should be something an owner reads, not something an owner hopes.
Money math that separates fact from estimate. Audited savings, like cancelled licenses and dropped duplicate tools, in one bucket. Modeled estimates, like downtime avoided, in another, labeled, with assumptions shown. A provider who blends the two into one impressive number is marketing, not reporting.
One accountable team on a flat bill. Whoever runs the stack owns the seams: identity, devices, email, network, backups, and the phone call when something breaks. A flat monthly bill with no contract keeps the incentive honest. The provider re-earns the business every month, in writing.
Any provider can be held to those four demands, and the good ones will not flinch. We designed SNSYS Shield around them: the score, the monthly report, the two-bucket math, one team on a flat monthly bill. The full approach is written up in a short white paper, One Outcome, One Bill. And the score itself is free: connect Microsoft 365 for a live read, or take the 2-minute check at snsys.ai/solutions/shield.
Sources
- 88% of small business breaches involve ransomware, Verizon 2025 Data Breach Investigations Report (DBIR)
- Average downtime cost of $427 per minute for small and midsize businesses, Datto
- Median annual cyber incident cost of roughly $8,300 for small businesses, Hiscox Cyber Readiness Report
- Multi-factor authentication blocks 99.9% of automated attacks on accounts, Microsoft Security