When small and mid-sized businesses begin investing more seriously in cybersecurity, looking to larger organisations for guidance can seem like an obvious place to start.
Banks, government agencies and major corporations often have established security programs, dedicated teams and sophisticated governance structures. From the outside, their approach can appear to represent a model of what good cybersecurity should eventually look like.
Luke Irwin believes SMEs need to be careful with that assumption.
As founder of Aegis Cybersecurity and a Cybersecurity Strategist & Advisor with more than 25 years of experience across technology, cybersecurity, risk and governance, Irwin has worked extensively with organisations trying to make sense of what an appropriate level of cybersecurity looks like for their business.
His view is that maturity should not be measured by how closely an SME resembles a large enterprise. A useful cybersecurity program is one that reflects the organisation’s actual risks, operating environment, obligations and resources.
That may lead to some of the same controls used by much larger organisations, but the reasoning behind them should begin with the business itself.
There Is No Universal Cybersecurity Program
Businesses differ significantly in what they need to protect.
A large financial institution handling sensitive data and operating complex technology infrastructure will naturally face different risks from a smaller professional services firm. A manufacturer may be heavily dependent on operational systems, while another business may be more exposed through customer information, third-party suppliers or cloud platforms.
Those differences shape what cybersecurity should look like.
Enterprise security programs are often supported by large teams, specialist technologies, formal governance functions and substantial budgets. Many of those measures exist because the scale and complexity of the organisation require them.
When smaller businesses copy the same structures without considering whether they solve the problems that matter most to them, they can end up creating unnecessary complexity.
Irwin’s approach begins by understanding the organisation’s exposure. What systems are essential to keeping the business operating? What information would cause the greatest damage if compromised? Which regulatory or contractual obligations apply? Where are the most significant dependencies?
Those questions provide a more useful basis for cybersecurity planning than simply asking what larger businesses are doing.
SMEs Cannot Afford to Treat Everything as a Priority
The cybersecurity market gives organisations no shortage of things to spend money on.
There are security platforms, monitoring tools, assessments, certifications, training programs and controls designed to address almost every imaginable form of risk. For businesses with finite budgets, the challenge is deciding which of those investments will actually make the greatest difference.
This is where copying enterprise programs becomes particularly problematic.
A larger organisation may be able to fund several cybersecurity initiatives at the same time. An SME is more likely to be choosing between them, often while cybersecurity spending competes with hiring, growth, operations and other business priorities. That makes prioritisation essential.
A sophisticated security tool can still be a poor investment if a more significant vulnerability remains untreated elsewhere. Similarly, a complicated control that the business does not have the people or processes to maintain may provide less value than a simpler measure implemented consistently.
For Irwin, cybersecurity investment should be commercially defensible. Leaders should understand what risk a particular measure is intended to reduce and why that risk deserves attention ahead of other competing priorities.
A smaller organisation does not need to address every possible risk at once. It does need to understand the choices it is making.
Where Frameworks Fit
Cybersecurity frameworks can help organisations bring structure to those decisions, particularly when they are unsure where to begin.
Aegis works with businesses across ISO 27001, SOC 2, SMB1001, the Essential Eight and broader cybersecurity maturity programs. Irwin also has direct experience with SMB1001 after Aegis became the first organisation globally to achieve Diamond certification under the standard and later the first to successfully complete a re-audit.
That experience has given Aegis an operational perspective on what it means to implement and maintain a cybersecurity framework rather than simply advise others about one.
For SMEs, frameworks can provide useful benchmarks and a clearer pathway for improvement. The important question is how they are applied.
A certification or maturity target should support the organisation’s wider cybersecurity objectives. If the process becomes centred entirely on completing controls or passing an audit, there is a risk that the underlying purpose gets lost.
Compliance can demonstrate that requirements have been met. It does not automatically tell leadership whether the organisation’s most significant risks have been reduced.
Proportionate Does Not Mean Minimal
One concern with the idea of proportionate cybersecurity is that it can sound like an argument for smaller businesses to do less. That is not the point.
SMEs can face substantial cyber exposure. Many hold sensitive information, rely heavily on digital infrastructure or operate in supply chains where larger customers increasingly expect them to demonstrate stronger security practices.
They may also have fewer resources available to absorb a serious disruption.
A large corporation can potentially withstand a prolonged outage, major recovery effort or substantial financial loss in a way that a smaller organisation cannot. For an SME, the same event may threaten its ability to continue operating.
Good cybersecurity therefore needs to reflect both the likelihood of an incident and the consequences if something goes wrong.
In some organisations, relatively basic improvements may significantly reduce risk. Others may require more sophisticated governance, specialist advice or formal compliance programs because of the way they operate.
The appropriate level of security comes from the organisation’s circumstances rather than its size alone.
Building Something the Business Can Maintain
Sustainability is another area where enterprise models can become difficult for smaller organisations.
Cybersecurity controls do not end when they are implemented. Policies need to be followed, systems need to be maintained and new processes need to fit within the way employees actually work.
A program that places unrealistic demands on the business can gradually deteriorate, even if it looked strong when first introduced.
For Irwin, practical implementation is an important part of cybersecurity maturity. A business should be able to operate the program it has created and understand the reasons behind it.
That means accepting that the ideal solution on paper may not always be the best solution in practice.
The stronger benchmark is whether the organisation understands its most significant risks and has made deliberate choices about how to manage them. Leaders should know what remains exposed, where resources are being directed and what outcomes they expect from those investments.
Large organisations can provide useful examples and lessons, but they should not become the default template for every SME.
A smaller business does not need an enterprise cybersecurity program to demonstrate maturity. It needs a program that makes sense for the business it actually is.
To learn more about Luke Irwin’s services and expertise, visit aegiscyber.com.au.
