As the President & COO of a security-first IT MSP, I’m focused on the rapidly changing digital landscape where small and medium-sized businesses face increasingly complex cybersecurity threats. From sophisticated ransomware operations to deceptively simple phishing attacks, the challenges confronting SMBs have never been more dangerous—or more frequent.
To help navigate this challenging terrain, I sat down with Mark Green, our Vice President of IT at Mural Technologies, for a candid conversation about the realities of cybersecurity for SMBs.
With over three decades of experience spanning roles at industry giants like Cisco and Symantec, Mark brings a wealth of battle-tested knowledge to our security-enabled MSP business.
This discussion explores the evolution of ransomware and offers practical steps SMBs can take to strengthen their security—even on limited budgets. Mark’s insights cut through the technical jargon to deliver actionable guidance based on real-world experience.
With 30+ years in the field, what security threats have you seen evolve dramatically, and which remain surprisingly consistent?
“Ransomware has undergone a mind-blowing evolution since I started in this field. Back in my Cisco days, we were dealing with script kiddies and basic viruses. Now? We’re facing sophisticated criminal enterprises with business models that would impress most VCs in the Valley. These aren’t basement hackers anymore—they’re running operations with dedicated development teams, 24/7 support desks, and affiliate programs that would make a SaaS company jealous. The double-extortion model—encrypting your data and threatening to publish it—is lucrative beyond belief and now automated.
But you know what keeps me up at night? Good old-fashioned phishing. It’s like that dive bar in San Francisco that never changes while the neighborhood gentrifies. The delivery mechanisms have gotten fancier—targeted spear-phishing, deepfake voice calls, SMS attacks—but the core technique hasn’t changed since the early 2000s: create urgency, exploit trust, get the click. Despite all our fancy tech and training programs, humans remain the most exploitable vulnerability in any system. Some things never change…”
Many SMBs believe they’re “too small to target.” How do you respond to this common misconception?
“I’ve heard that line since my days at MCI—and it wasn’t true then either. Cybercriminals aren’t checking your employee count before launching an attack. Most threats today are automated and opportunistic. They’re scanning for vulnerabilities, not researching your revenue.
The hard truth? SMBs are preferred targets. They often have weaker defenses but still manage valuable data. I’ve seen ransomware groups specifically target companies with 50–250 employees—they’re big enough to pay but too small to have strong security.
You don’t need to be a specific target to become a victim. It’s like street crime in the Bay Area—you’re just in the wrong place at the wrong time with the wrong security posture. And when SMBs get hit, the impact is often devastating. I’ve seen too many shut down entirely after a breach.”
How has the rise of remote and hybrid work changed the security landscape for small businesses?
“When COVID hit, everything changed overnight. We used to build hardened perimeters—then suddenly, employees were accessing critical systems from kitchen tables while their kids Zoomed into class. The traditional network edge dissolved.
Now, it’s not just about securing an office—it’s about securing hundreds of mini-branch offices spread across homes, coffee shops, and hotels. Identity has become the new perimeter. At Symantec, we were already moving toward zero-trust, but remote work put that into overdrive.
The BYOD situation? A mess. I’ve seen mission-critical data on unpatched laptops connected through routers with default passwords. It’s like leaving your front door wide open.
But there’s a silver lining. This shift has pushed SMBs to modernize. Those embracing cloud security, strong authentication, and endpoint protection are adapting well. Are those clinging to traditional perimeters? They’re fighting a losing battle. I’ve seen it play out time and time again.”
If an SMB has a limited security budget, what should they prioritize?
“I’ve narrowed it down to three high-impact investments:
- Multi-Factor Authentication: It’s the closest thing to a silver bullet. Even basic MFA drastically reduces risk by making stolen passwords useless.
- Robust Backups: Follow the 3-2-1 rule—three copies, two media types, one offsite and offline. And test recovery. A backup you can’t restore is worthless.
- Security Awareness Training: Technology can’t protect you if your people can’t spot a phish. I’ve seen million-dollar security stacks undone by one bad click. Train your team—especially in SMBs.
Notice I didn’t mention expensive EDR or SOC services. They’re great if you can afford them, but these three basics will prevent the majority of breaches I’ve encountered in 30 years.”
What’s your playbook for responding to a breach in the first few hours?
“When a breach hits, those first few hours are critical. I’ve been in the SOC watching it unfold—and I’ve been the guy getting 2 AM calls. Over time, I developed a four-step framework I call CALM that’s helped save countless clients from disaster.
C is for Contain. Isolate affected systems—don’t shut them down. You need the forensic evidence. Too many teams wipe machines and destroy key data before understanding what happened.
A is for Assess. Quickly determine what systems and data were affected. This isn’t a deep dive—it’s triage. Just enough to guide next steps.
L is for Legal and Leadership. Breach disclosure laws are strict, and the clock starts at discovery. Bring in legal immediately and brief your execs. Trying to quietly handle a breach can backfire badly.
M is for Mobilize. Activate your IR team or partners. If those relationships aren’t in place before an incident, you’re already behind. At Cisco, we saw recovery costs triple when companies scrambled mid-crisis.
And throughout the process—document everything. Every action, every finding. It’s critical for insurance, legal, and future protection. I still keep incident journals from some of the most intense cases. They’re like battle scars.”
What security metrics actually matter for SMBs?
“Metrics can overwhelm if you’re tracking everything. Focus on the few that drive results:
- MTTD and MTTR: How fast do you detect and respond? These directly impact breach costs.
- Patch compliance: Are you fixing critical vulnerabilities on time? It’s not sexy, but it works.
- MFA adoption: You’re exposed if it’s not 100% on privileged accounts. I’ve seen ‘secure’ orgs get breached due to this single gap.
- Phishing simulation results: Are employees spotting threats? This is one of the most actionable indicators of security readiness.
What doesn’t matter? Number of attacks blocked or tool deployment stats. Tools don’t equal protection. Focus on outcomes, not activity.”
How do you strike the right balance between security and usability?
“This is the challenge. You can build a Fort Knox security model—but if users can’t do their jobs, they’ll find workarounds. And that kills security.
The key is right-sized controls based on risk. Use stronger protections for high-risk actions (like wire transfers) while keeping everyday workflows seamless.
User experience must be part of your security design from day one. Every extra click reduces compliance. The best controls are invisible—or at least intuitive.
And don’t design in a vacuum. Shadow your users. Understand their workflows. Too many security teams build in theory, not reality.”
What new threats should SMBs watch for in the next 12–24 months?
“I’m watching four significant trends:
- AI-powered phishing. I saw a demo in which the AI mimicked writing styles so well that even I was fooled. The bar for attack quality is dropping fast.
- Supply chain attacks. Why hit 100 companies when you can compromise their shared vendor? It’s no longer just nation-state actors doing this.
- Access mining. Attackers breach systems, then sell that access on the dark web. The damage comes later—and it’s harder to detect.
- Mobile malware. It’s matured. Traditional defenses aren’t enough anymore, and most SMBs don’t take it seriously yet.
The bottom line is that SMBs need to tighten their defenses not just around the perimeter but also around people, partners, and devices.
In such a crowded cybersecurity space, how does Mural Technologies stand out—and what do clients say resonates most?
“After decades in this industry—from Cisco to Symantec—I’ve seen most MSPs treat SMBs like mini enterprises. They throw scaled-down enterprise tools at them and call it a solution.
At Mural, we flipped that. We start with your business processes, not technology. One client had three expensive tools no one knew how to use—that’s not security, that’s shelf-ware.
Clients appreciate our pragmatic, right-sized approach. We don’t push tools you don’t need or can’t support. Our fractional CISO service has been a game-changer for SMBs needing executive guidance without the full-time cost. One client told me, ‘For the first time, security works for our business—not against it.’
And unlike others, we focus just as much on resilience as prevention. Breaches happen, even with the best defenses. We make sure our clients can recover fast. That’s saved more than a few from going under—something their last providers never prepared them for.”
Cybersecurity That Moves With Your Business
Mark shared that cybersecurity for SMBs isn’t about using every tool or chasing the latest trend. It starts with understanding your business and applying the right-sized controls that protect what matters without slowing you down.
The threat landscape is evolving—AI-driven phishing, supply chain risks, access mining, and mobile attacks are just the beginning. But with essentials like multi-factor authentication, smart backups, and strong security culture, SMBs can stay ahead.
At Mural Technologies, we don’t sell overkill. We deliver practical, resilient security programs tailored to your business processes and budget—security that works with your business, not against it.
Ready to take control of your security posture? Let’s build a smarter, stronger approach—without the jargon or unnecessary complexity.
Visit our Managed IT Services for Small Businesses page, email us at connect@mural.cloud, or call (888) 466-8725. Your business deserves security that supports growth.