Cost-Effective Risk Management Strategies
for small and medium-sized organizations
For small and medium-sized organizations (aka SMBs) without a dedicated Information Security or Enterprise risk function, deciding where to allocate limited time and resources to enhance information security can be challenging. The information security threat landscape evolves constantly. Organizations face contractual obligations with customers and third parties. Companies are also required to manage ongoing regulatory and compliance changes. So, where should your efforts be focused?
Here are the two focus areas we believe provide the most “bang for the buck” to enhance the security posture for SMBs:
1. Spend time strengthening your risk management program
A robust risk management program is proactive and requires dedicated planning. It identifies your organization’s most significant risks and ensures resources are allocated effectively. Dwight Eisenhower once said, “In preparing for battle, I have always found that plans are useless, but planning is indispensable.” Investing time to challenge, evolve and enhance you risk management program will be time well spent.
An example is spending time considering the rapid proliferation of artificial intelligence (AI). While AI offers numerous benefits, it also creates new risks and vulnerabilities that malicious actors can exploit. Key AI-related threats include:
- Sophisticated phishing attacks: Highly personalized and harder to detect
- Increased attack frequency: Faster, automated exploitation of vulnerabilities
- Deepfake attacks: Impersonation of organizational leaders or employees
- AI system exploitation: Including model inversion attacks, adversarial attacks, and API exploitation attacks
- Accelerated insider threats: Malicious insiders using AI to exfiltrate data more effectively.
2. Stay up-to-date on recent changes to compliance requirements
such as SEC Cybersecurity rules, PCI DSS standards, GDPR updates, and state-specific privacy laws. More robust data protection laws are required for many organizations, including:
- Enhancedincident management and reporting.
- Strengthenedsupply chain security, including vendor and third-party management.
- Improved encryption standardsfor data transmitted over public networks.
- Greater resilience against hostile AI attacks.
Regularly, organizations are required to meet security standards as a stipulation of an SLA with their customers and other third-parties. While meeting these standards alone can be a challenge, often times, it also requires investments in technology and other resources.
3. Align your technology risks, compliance requirements, and contractual expectations
Given the complexity of today’s threat landscape, you cannot address all risks equally. A good risk management program strategy prioritizes risks and addresses them in different ways. There are four common approaches to address any risk.
- Avoidance: Eliminate the risk by avoiding the activity that creates the risk.
- Mitigation: Minimize the likelihood of the risk occurring.
- Transference: Shift the risk to another party, through contracts, insurance, or outsourcing.
- Acceptance: Accept the risk because its impact is deemed manageable or the cost of addressing it is prohibitive.
Determining the correct strategy for any given risk depends on several factors including likelihood of the risk, cost to mitigate or transfer, potential impact, and organizational risk tolerance, among others. The decisions with be different for each organization. For example, an organization might:
- Invest in an AI incident management solution to improve threat detection and incident response
- Dedicate management resources to identify security threats to the organization and controls to minimize the threats
- Conduct security training on phishing, deepfake technology, and incident management
- Evaluate cyber insurance coverage to ensure adequate coverage
- Invest in security certifications and training for key team members to deepen knowledge in new technologies, risks, and compliance requirements.
Whatever your approach, proactive management is essential. Data security requirements at your organization change regularly, not only because of changes to regulatory compliance requirements, but because of the ingenuity and persistence of malicious actors. Regulatory and compliance requirements often change years after bad actors have already compromised your data. By proactively addressing organizational risks, you can effectively safeguard your organization’s data in 2025 and beyond.
Peter Clarke (Vice President , AARC-360)
