Most businesses shop for security like a grocery list. Something goes wrong, or an auditor asks a hard question, and the reflex is to buy – another tool, another dashboard, another line on the renewal. Then the question becomes, "what else do we need?"
It's the wrong question. Or rather, it's the right question asked far too early.
You can't know what you need until you know two things: where you are now, and where you're actually trying to get to. And here's the part most security marketing skips – that second answer isn't the same for every business.
Take a small firm – say, 30 people. The goal usually isn't a wall of certifications. It's simpler and more urgent: don't get shut down by ransomware, don't cop a data protection fine, keep trading without a security bill that eats the margin you're in business for. "Secure" here means proportionate and resilient – and being sold enterprise-grade compliance tooling is being mis-sold.
Now take a business bidding for a contract that demands certification, or one already sitting under a regulator's eye – POPIA and the Information Regulator, say, or a customer's own compliance questionnaire. Their target isn't a preference; someone else has set it for them. "Secure" now means being able to prove it, on demand, with evidence. A drawer full of tools that can't produce that evidence isn't security, it's spend.
But don't read that as "small means relaxed, big means strict" – that's the mistake. A 30-person medical practice or financial advisory can carry heavier obligations than a large manufacturer. It's not about size. It's about what data you hold, what sector you're in and who you answer to.
Same underlying question and often opposite answers – and notice neither of them starts with buying a tool. One business might learn it's more covered than it feared and shouldn't spend at all. Another might own three products and still fail an audit. You can't know which conversation you're in until you've asked where the business stands, and where it has to get to. Even the assumption underneath – do you actually need to be compliant, or have you just decided you do? – is worth testing before a cent is spent.
The order that works is the reverse of how most buying happens. Identify where you are and where you're going. Uncover the gaps that actually matter. Agree the processes and the people who'll run them. Then deploy the tools – last, into a shape that's already been defined. Tool-first feels like progress because you've spent money and something got installed. But a tool dropped into an undefined environment doesn't close a gap; it just hides it behind a green tick.
A Cyberwin partner had a client come to them with a simple question: what more do we need? On paper the business looked in good shape – a mid-sized accountancy firm with multi-factor authentication in place, tidy control over who could access what, and access shut off the moment someone left. The easy move would have been to sell them another product. Instead the partner started with a structured readiness check – a short set of pointed questions to establish where the business actually stood before recommending anything.
The picture changed. The firm was well defended at the front door and had almost nothing behind it: no backup that had ever been tested, no plan for who did what if something went wrong, and no one who actually owned security as part of their job. For a business holding client financial records, that wasn't a technology gap – it was a governance one, and no new product on its own would have closed it.
None of it was visible from the outside. It only surfaced because someone asked the right questions in the right order – and the honest answer to "what more do we need?" turned out to be "let's find out where you actually stand first".
That's the whole point. The most secure businesses aren't the ones with the most tools. They're the ones that know where they are before they spend — so every tool they do buy lands in the right place and does the job it was bought for.
So before your next purchase, one honest question: do you actually know where you are right now?
Start with a Readiness Check
The Cyberwin Readiness Check is a short, structured conversation that establishes where your business stands today and where it needs to get to. No cost, no obligation and no product recommendation attached to it. Where it identifies gaps that matter, we'll tell you what they are and what closing them involves. Where it doesn't, we'll tell you that too.
Book a Readiness Check — Samantha@cyberwin.co.za
Cyberwin operates internationally. The same Readiness Check is available to UK and EU standards – contact sean@cyberwin.co.uk.
Share
