Cybersecurity in SMEs: from firewall to business risk

For years, in many SMEs cybersecurity has been experienced as a maintenance matter: up-to-date antivirus, configured firewall and little more. The debate, as Computerworld reports based on the vision of Kyocera Document Solutions, has focused on protecting infrastructures, devices and applications against external threats. That protection is still essential, but it is no longer enough. The attack surface has expanded, companies depend on more technologies and providers, and information circulates through increasingly distributed environments. At ForgeNEX we see it daily in Sevillian SMEs: technological risk is increasingly business risk.

What changes in the conversation

The original article puts it clearly: the question is no longer how many incidents have occurred or how many threats have been blocked, but what impact a specific risk would have on the company's activity and what capacity we have to prevent it, detect it and recover from it. That change of approach has an immediate consequence: security enters management conversations.

For an SME, this means that the IT manager can no longer be the only one talking about security, nor the external provider the only one executing it. It is necessary that whoever decides about the business understands what is being protected and why. In small organizations, where roles overlap, this translates into something very concrete: reserving a periodic space to review technological risks with management, not only to put out fires.

The relationship between CIO and CISO, applied to the SME

The text proposes that the relationship between CIO and CISO should not be built on an auditor and auditee logic. Security cannot be a review that arrives at the end of a project, but a variable that is part of the decision from the beginning. In an SME both roles do not always exist, but the principle holds: whoever designs the solution and whoever monitors the risk must talk before hiring, not after.

When both perspectives work in isolation, friction appears. When they are integrated from the start, risk decisions are better informed. In practice, this translates into incorporating security into the design of any project: identity, permissions, data protection, monitoring, continuity and recovery should not be added once the solution is already deployed.

Three areas that accelerate the change

The article identifies three fronts that are driving this evolution and that fully affect any IT team:

• Identity. It has become one of the main security perimeters. In environments where people access from different locations and devices, protecting only the infrastructure is not enough: you must know who accesses, what information and under what circumstances.
• Data. Its value grows, but also the need to control where it is, who can use it and how it is protected.
• Artificial intelligence. It adds complexity: data used by models, privacy, access, traceability and the use employees make of these tools.

At ForgeNEX we have already seen how these fronts intersect in the day-to-day life of an SME. For example, when choosing a Microsoft 365 Business plan, the decision is not only about price or storage: it is about what identity and data protection controls each level incorporates. And when generative AI is adopted, it is advisable to apply the same lessons we already saw in the case of Goldman Sachs and Claude Code: define what data can leave, who can use it and how its use is audited.

From prevention to resilience

The article says it bluntly: no organization can assume it will be completely free of incidents. The question is not only how to avoid an attack, but what capacity we have to respond when it happens and how long it will take us to recover activity. Resilience thus becomes an essential part of the strategy.

This implies knowing the critical processes, identifying technological dependencies, establishing recovery mechanisms and periodically testing that they work. Also being clear about who decides during an incident and how the organization communicates. In an SME, this can start with something as simple as documenting which systems are essential to invoice, serve customers or meet obligations, and verifying that a recoverable copy of that data exists. Data resilience stops being a topic for large corporations and becomes an operational necessity.

What we recommend from ForgeNEX

The big change described in the article consists of stopping understanding cybersecurity as a layer that protects technology and starting to consider it a capability that protects the continuity and evolution of the business. For an SME, this translates into concrete actions:

1. Include security in the decision, not afterwards. Before hiring a cloud tool, a CRM or an AI system, review identity, permissions, data and recovery.
2. Talk about risk in management. Translate technical incidents into impact on activity: what stops, how much it costs, how long it takes to recover.
3. Organize identity. Review access, onboarding and offboarding, and apply the least privilege possible.
4. Test recovery. Having copies is not enough: you must verify that they are restored and within what timeframe.
5. Define the use of AI. Establish what data can be entered into AI tools and how their use is traced.

It is not about slowing down innovation until any risk is eliminated, something the article itself dismisses as unrealistic. It is about knowing the risk, deciding how to mitigate it and establishing what level is acceptable for the business. In an SME, that conversation —between whoever understands technology and whoever understands the business— is what makes the difference between reacting to an incident and managing a risk.

Source: Computerworld. Analysis and adaptation: ForgeNEX.