Cybersecurity challenges for SMEs and ROI complexities

Small and medium-sized enterprises (SMEs) face evolving challenges in establishing effective cybersecurity frameworks. Rather than simply choosing between antivirus or EDR tools, businesses must identify specific risks to implement a foundation of complementary protections, including workstation security, email protection, firewalls, backups, and account management. While there is no universal regulatory minimum, the GDPR requires technical measures for personal data, and the NIS2 directive imposes specific requirements on certain sectors regarding risk management, incident response, and supply chain security.

Simultaneously, Chief Information Security Officers (CISOs) struggle to calculate the return on investment (ROI) for cybersecurity spending. The rise of artificial intelligence has expanded attack surfaces, making it difficult to quantify the costs of hypothetical threats. There is a growing need to shift from a cost-avoidance paradigm—justifying budgets based on preventing attacks—to a model that values security investments as a core business component. Despite increased awareness, many organizations still struggle to justify budgets until after an initial attack has occurred.