SMB IT & Cybersecurity Decision Survey

You are a senior leader in your organization

What industry is your organization in?

How many employees does your organization have?

Which of the following best describes your primary IT/security provider? (Select all that apply)

We have a full, in-house cybersecurity and IT team

We have a Managed Service Provider (MSP) that handles it

We have multiple MSPs, one for IT and one for cybersecurity

We have a mix between in-house and MSP

We don't have anything in place

We have a bunch of cyber tools that our IT team tries to manage

Are the responsibilities of cybersecurity and IT the same thing to you?

Which technology support model would you prefer for your organization?

One provider responsible for both IT support and cybersecurity.

Separate providers—one focused on IT and another focused on cybersecurity.

An IT provider that offers optional cybersecurity services as add-ons.

Which type of provider would you rather work with? (I know the true answer is that you want both, but I'm trying to learn what is more valuable to business leaders between general IT and cybersecurity)

A provider that is stronger at cybersecurity (even if general IT / helpdesk support is average)

A provider that is stronger at general IT and helpdesk support (even if cybersecurity is only basic/standard)

Which statement best reflects your organization's philosophy when investing in IT and cybersecurity?

We prefer the lowest monthly cost, even if it means accepting more risk.

We want a balance between cost and protection.

We are willing to pay more for significantly better security and expert IT support.

We want enterprise-level protection regardless of whether it costs more.

What is effective cybersecurity protection and IT management worth to your organization on an annual basis? (This is not asking for your current budget — it is asking what you believe strong cybersecurity is actually worth to the business.)

$50,001 – $100,000

What factors influenced your answer on the last question?

Regulatory requirements

Cyber insurance requirements

What would most likely trigger you to invest more in cybersecurity or change providers?

Compliance requirements

Poor response during an incident

Poor communication

An audit or compliance failure

Recommendation from a trusted advisor or peer

What is the biggest red flag that causes you to lose trust in a cybersecurity company during the sales process?

Focusing only on fear / scare tactics (“You’ll get breached tomorrow”)

Talking about tools (e.g., EDR) instead of business outcomes and risk reduction

Lack of understanding of SMB realities or your specific industry

What are the biggest cybersecurity/IT challenges or pain points your business faces today? (Select up to 3)

Lack of proactive threat monitoring / response

Too many security tools / complexity

Insufficient protection against ransomware / phishing / business email compromise

MSP only provides basic EDR (e.g., SentinelOne) without deeper strategy

Compliance / regulatory requirements (e.g., HIPAA, PCI, SOC 2)

High cost of security tools or services

Lack of visibility / reporting

Employee training & human error

Our current provider is a poor communicator

What are the most important things you want to hear from a IT/cybersecurity company in the initial sales process? (Select up to 3)

Transparent, predictable pricing

Fast, no-obligation assessment of your current gaps

Their positive impact on your insurance

They'll help make you compliant

How they strive to understand your business and align the security accordingly

How and when would you prefer a IT/cybersecurity vendor to approach your organization? (Select the options that fit best)

After a security incident or near-miss has occurred

Via a warm introduction from a trusted advisor, peer, or existing relationship (E.g. an attorney, CPA, broker, etc.)

Through educational content (webinars, reports, gap assessments) first, then a conversation

Only if/when we proactively reach out or request information

At industry events or local business groups

A brief educational email with useful insights

At the end of the day, who ultimately owns your cybersecurity risk?

Our managed service provider (a vendor providing security services)

How confident are you that your organization could stop a cyberattack before it caused significant damage?

Extremely confident

Somewhat confident

What is the biggest barrier preventing you from improving your cybersecurity posture?

Lack of time / internal expertise to evaluate options

The sales process is painful

Complexity of choosing the right solution

Don’t see enough risk to justify spend

If an independent security expert offered a $999, tax-deductible "Security Validation Assessment" to verify whether your current IT provider is actually delivering the security you're paying for—how likely would you be to use it?

Very likely (I want a trusted second opinion)

Maybe, if it cost less

Which outcome would provide the greatest value to your business?

Reduce business risk

Prevent attacks and system down-time

Lower cyber insurance costs

Meet compliance requirements

Protect our reputation

Gain executive peace of mind

Which best describes your cybersecurity investment philosophy?

We invest proactively because we understand the risk.

We invest when risks are identified.

We invest only when required by regulatory obligations.

We only react after problems occur.

Imagine you had the best cybersecurity in the world. What would be different?

I'd worry less about ransomware.

I'd feel more confident presenting to our board.

I'd trust my technology partners more.

My clients would trust my company more

I'd have fewer operational interruptions.

Do you see value in having one vendor for all of your security and IT needs over having several vendors that each offer a single piece of your requirements? E.g. A camera company, consultants, an MSP, an access control company, cyber software, etc..