What cybersecurity help does my business need?

Start with what's happening, not what the service is called

Before deciding what cybersecurity service you need, describe the situation you're trying to deal with.

That might sound obvious, but it changes the conversation.

Instead of asking:

Do we need a vCISO?

Start with:

Nobody here really owns security and it's becoming difficult to manage.

Instead of:

Should we get a pentest?

Start with:

We're about to launch this product and want independent assurance that we've not missed something important.

And instead of:

Do we need GRC?

Start with:

A major prospect wants evidence of our security controls and we're struggling to provide it.

Those problems may eventually lead to a vCISO, penetration tester or GRC specialist. But starting with the situation gives you a much better chance of finding the right expertise.

A customer is asking difficult security questions

This is a common point at which smaller companies discover that their security has become a commercial issue.

A prospect might send a detailed security questionnaire, ask for policies and evidence, want to understand how you manage risk, or make a recognised security standard part of the deal.

The right help depends on what they're asking for and what you already have.

If the problem is demonstrating controls, policies and governance, you may need GRC or customer assurance support.

If the customer requires a particular certification or framework, you may need someone experienced with ISO 27001, SOC 2, Cyber Essentials or the relevant requirement.

If you're repeatedly encountering these questions and nobody internally owns the overall security programme, the underlying need may be broader than completing one questionnaire.

The questionnaire is sometimes the symptom rather than the problem.

You're worried about the security of your product

Perhaps you're launching something new, making a significant change, preparing for an enterprise customer or simply haven't had an independent pair of eyes on the product for a while.

This is where terms such as penetration testing, application security, cloud security, vulnerability management and security assessment start appearing.

They aren't interchangeable.

A penetration test is a focused exercise designed to identify exploitable weaknesses in a defined target. It doesn't automatically tell you whether the wider way you build, deploy and operate your product is appropriate.

Application security expertise may be more useful if you need to improve security throughout development rather than test a finished system.

Cloud security support may be appropriate when the concern sits in your architecture, configuration, identities or cloud environment.

Start with what you want to understand or achieve. Then decide which discipline gets you there.

You've been told you need to become compliant

“Compliance” can cover an enormous amount of territory.

You might have a contractual requirement from a customer, an industry obligation, a certification you're pursuing or a broader need to demonstrate that sensible controls exist.

Before engaging anyone, establish what is driving the requirement.

There is little value in racing towards a certification because somebody vaguely suggested that you “need ISO” if your immediate commercial requirement is something entirely different.

Good compliance and GRC support should help you understand the requirement, identify the gap between where you are and where you need to be, and build an achievable route between the two.

The destination matters before you start buying maps.

Something has happened

A suspected breach, compromised account, ransomware incident, leaked credential or unexplained activity is different from routine security improvement.

You may need incident response or digital forensics expertise, particularly where the situation is active, the scope is unclear or sensitive data may be involved.

Speed matters, but so does getting appropriate help.

Avoid turning an active incident into a shopping exercise involving twelve tabs and a comparison spreadsheet. Establish what has happened, preserve relevant evidence where possible and find appropriately experienced incident support.

Once the immediate situation is under control, the work often changes. Recovery, remediation and understanding how to reduce the chance of recurrence can require different expertise from the people dealing with the incident itself.

Nobody really owns cybersecurity

In smaller businesses, security often starts as part of somebody else's job.

The CTO handles some of it. IT handles another part. Engineering makes security decisions. Someone in operations deals with questionnaires. The CEO gets dragged in when a large customer asks an awkward question.

That can work for quite a while.

Eventually, however, the number of security decisions grows while ownership remains fuzzy.

This is where security leadership or vCISO support can make sense.

A vCISO can provide experienced security leadership without the business immediately hiring a full-time CISO. Depending on the engagement, that might include setting priorities, building a security programme, advising leadership, supporting customer requirements, coordinating specialist suppliers and helping the business understand which security investments are worth making.

But not every company with a security problem needs a vCISO.

If your immediate requirement is a clearly defined piece of specialist work, hiring the specialist directly may be the better answer.

Sometimes you don't need outside cybersecurity help

This possibility tends to disappear from conversations about buying cybersecurity services.

Not every security question requires a consultant.

You may already have the expertise internally. The problem might be small enough for your existing team to resolve. You might need to improve a process rather than bring in another supplier.

And sometimes the sensible answer is to wait.

The purpose of diagnosing the problem first isn't to find something to buy. It's to work out what, if anything, would help.

That distinction matters.

You might need more than one kind of expertise

Cybersecurity problems don't respect service categories.

A company preparing for an enterprise customer might discover it needs some GRC support, an independent test of its product and somebody to take longer-term ownership of security.

An incident might expose weaknesses in identity management that subsequently require technical remediation and improvements to operational processes.

This doesn't necessarily mean assembling an army of consultants.

It means understanding the problem well enough to distinguish what needs attention now, what can wait and which skills are appropriate for each part.

Common questions