Dive Brief:
- IT teams at small and midsize businesses are struggling with oversized security responsibilities, according to a survey of 361 SMB leaders by cybersecurity software provider CyberFox. Nearly two-thirds of respondents said limited staffing has left important security risks unaddressed, and almost half reported their most significant known security gap was left open for at least six months.
- Three-quarters said security responsibilities have grown faster than IT headcount over the past three years. Nearly 4 in 5 respondents at companies with IT teams under 15 people said they had implemented a cybersecurity solution their teams could not fully deploy or manage.
- Midsize companies are turning to managed security providers to bridge security gaps, CyberFox CTO Andrew Bensinger told Channel Dive. “A lot of these smaller IT teams are overworked and under-budgeted,” he said. “They can’t take on everything that’s on their plate, and now they’re asked to be a security expert. And then you layer on top of that, they instantly have to become an expert in AI policy and security. They’re overwhelmed.”
Dive Insight:
As AI adoption complicates IT environments, SMBs operating with budget and staff constraints are feeling the burn.
Many SMBs use legacy systems and are still working on data modernization and cloud migration, according to Julianne Rose, director of enterprise marketing at CyberFox. Convincing executives to prioritize AI risk or privileged access management over customer-facing IT work can be difficult.
“IT is still seen as a cost center,” Rose said. “Those in the know are still struggling to get the message across and get the funds available against other priorities.”
MSPs are a vital part of the SMB toolbelt. Nearly two-thirds of respondents said they use an MSP or managed security services provider for at least one IT or cybersecurity function. Organizations with fewer than 15 internal IT employees were almost twice as likely to use an outside provider as those with larger teams.
“MSPs can really assist these small IT teams in bringing expertise and being the subject matter expert in areas where they're weak, and a lot of times from budgetary purposes, it is a lot easier to bring in an expert than to say to your boss or management, ‘We need to hire more staff,’” Bensinger said.
More than two-thirds of SMBs using service providers said their provider frequently helped implement a security control the internal team lacked the time or expertise to manage on its own.
SMBs face new governance and risk management challenges associated with AI. One in 5 respondents said AI-related initiatives have delayed or deprioritized a planned cybersecurity project. That number rose to 2 in 5 among IT leaders surveyed.
Bensinger said service providers should educate SMBs about the risks associated with AI and automation. CyberFox, which markets its automated privileged access management tool AutoElevate, is also balancing the risks and benefits of AI for MSP customers and end clients.
“We're going to leave it up to the IT departments, the MSPs, to make the decision of which level of risk they're willing to take with AI assistance with regards to the use of our cybersecurity applications,” Bensinger said. “But we will make it available for them to use.”
