What "Do-It-Yourself" Security Actually Looks Like
Most businesses think they're handling it. Here's what's usually actually happening.
Built-in Windows Protection
Basic antivirus, no monitoring, no response team, alerts go nowhere
Your Email Provider's Spam Filter
Catches obvious spam, but misses sophisticated phishing and business email compromise
"Be Careful" Training
Telling staff to "watch out for phishing" without testing or ongoing education
No Security Monitoring
Nobody watching for threats 24/7—attacks happen whenever attackers choose
No Incident Response Plan
When ransomware hits, who do you call? What's the process? Where are the backups?
No Compliance Documentation
HIPAA, PCI DSS, cyber insurance requirements—hoping you never get audited
This Worked... Until It Didn't
Every business that got hit by ransomware said the same thing: "We thought we were fine. We'd never had a problem before."
The Real Risks You're Taking
These aren't scare tactics. These are documented statistics from real businesses.
Financial Risk
- Recovery costs: Forensics, legal, notification, credit monitoring
- Cyber insurance: May refuse to pay if you lack basic security controls
Business Risk
- Reputation damage: Customers lose trust, contracts are lost
- Customer data breach: Notification requirements, lawsuits, regulatory fines
- Competitive disadvantage: Competitors with security certifications win your bids
- M&A impact: Security issues discovered during due diligence kill deals
Legal & Compliance Risk
- State data breach laws: Mandatory notification, potential fines
- Customer lawsuits: Class actions after breaches exposing personal data
- Regulatory audits: Can't produce required security documentation
Insurance & Contract Risk
- Cyber insurance requirements: Many now require MFA, EDR, email security
- Claim denials: Lack of "reasonable security measures" voids coverage
- Contract requirements: Vendors require security questionnaires, certifications
- Lost opportunities: Can't bid on contracts requiring security standards
- Premium increases: Insurance costs skyrocket after an incident
"We're Too Small to Be a Target"
This is the most dangerous assumption in cybersecurity.
Attackers use automated tools that scan the entire internet looking for vulnerabilities. They don't care about your company size—they care about whether you're protected.
Small businesses are actually MORE attractive targets because:
- •They typically have weaker security than large enterprises
- •They often lack dedicated security staff
- •They're less likely to have incident response plans
- •They're more likely to pay ransoms to get back online quickly
- •They're used as stepping stones to attack larger partners/customers
Ransomware doesn't discriminate by company size. It encrypts files and demands payment whether you're a 5-person firm or a Fortune 500.
Talk to Craig About Your Situation
Talk to a person about where your business stands today.
Talk to Craig About Your Situation
Tell us how this is handled today and what you are seeing. We will look at it with you and tell you what we found and what we did not.
(•••) •••-••••
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.