Модели ценообразования станут ключевым фактором развития кибербезопасности на рынке среднего бизнеса

Security maturity in the mid-market over the next few years will be decided as much by pricing models as by technology. By Christo Coetzer, founder and MD of BlueVision Technologies. The most important question a growing business can put to a prospective security partner may not be “what can you see?” but rather “what will it cost me, predictably, to keep seeing it?” The Monitoring Conundrum If you are a CISO, or a business leader or FD, trying to make sense of, and justify, the cost of keeping your organisation safe you may have been presented with a conundrum. It can also be described as a contradiction that lies at the heart of how most security monitoring systems are sold. You need to monitor, that’s a fact, if you can’t see it – how can you prevent or stop a cyber breach. The entire purpose of monitoring is to increase your visibility across your environment, view more of the activity within it and receive early warnings that something is amiss. Yet the dominant commercial models charge you for precisely that: the more you watch, the more you pay. It is a pricing structure that penalises the very concept on which it is based which is to be able to see more. Most enterprise monitoring platforms bill by volume – by the gigabyte of log data ingested, or by the number of alerts processed. On paper this sounds reasonable but in practice it makes the security budget almost impossible to forecast. A single misconfigured firewall, a new endpoint agent, or a routine change to a Microsoft 365 logging policy can double the volume of data flowing into the system overnight and with it, the monthly bill. Independent analyses of these platforms describe this “chatty” behaviour as a well-documented risk, with per-gigabyte list prices running into thousands of dollars per gigabyte/per year. The finance team is left signing off on a line item that can swing sharply in either direction for reasons that have nothing to do with a decision anyone actually made. The predictable response is the wrong one. When visibility carries a variable and rising cost, teams begin to economise on it by logging less, retaining data for shorter periods and switching off the sources that generate the most noise. Each of these decisions is rational on a spreadsheet and dangerous in a breach. Often, organisations end up buying less of the one thing monitoring tool exist to provide and that’s visibility. Instead, businesses quietly, one cost-saving at a time, continue to cut back until the gap in coverage is discovered only after the fact of a breach. Why mid-sized businesses are most vulnerable to this badly constructed costing model The pressure is felt hardest with mid-sized businesses. They are large enough to be a worthwhile target and to hold data worth stealing, but they do not have the budget of a large corporate to absorb an unpredictable security bill. And the licence fee is only the visible part of the cost. Independent analyses put the full cost of running an enterprise-grade monitoring platform, for an organisation of a few hundred staff, at several hundred thousand US dollars a year once storage, tuning and above all, people are factored into the picture. The latter is due to the fact that a monitoring platform is only as useful as the analysts watching it. That last cost is not easily solved with money alone, the global shortage of cyber security professionals runs into the millions of unfilled roles, and a mid-market business competing for that scarce talent will usually come off second best. The result is a protection gap that maps almost exactly onto the budget gap. The companies least able to fund enterprise security are, by most measures, the ones a breach would hurt most. It is estimated that the cost of a single incident to a smaller business runs from the low hundreds of thousands, into the millions. Yet, where a clear majority of large enterprises carry cyber insurance, only a small minority of smaller businesses do with the same divide appearing in a different column. The businesses that can least afford to be breached are, too often, the least equipped to withstand it. The instinct, faced with all this, is to reach for more technology but the core problem here is not  technical, it is commercial. The reason good monitoring is out of reach for so much of the market is the shape of the pricing, not the sophistication of the tools. The need for change If the commercial model were to be changed with a decoupling of the cost of monitoring from the volume of data it happens to generate and it was to be priced predictably against something stable, such as the number of people in the business, the incentive inverts. Visibility becomes a fixed decision made once, rather than a variable cost second-guessed every month. Enterprise capability can then be sized and priced for a business that is not, itself, an enterprise. This is the principle behind BlueVision’s Fusion Cloud service: it is a fixed, per-seat subscription rather than a meter that runs faster the more closely you look, and the monitoring itself is validated by analysts rather than left as raw volume for an in-house team to drown in. The specific offering matters less than the shift it represents – from a model that rations visibility to one that treats it as a baseline.