From IT to Information Security: What Changes, and What It Costs

If your IT provider also owns your security, nobody is checking their work. That is the honest version of this whole topic. Information security is a separate discipline with its own governance, its own evidence and its own incentives, and the moment a business treats it as a sub-task of keeping the laptops working, the cheap option wins every argument.

This is not an argument for a security department. Most businesses reading this have between five and two hundred staff and will never have one. It is an argument for naming security as a function, writing down who owns it, and buying the parts you cannot staff. Below is what changes when you do that, what the current numbers justify spending, and the order to do it in.

Two different jobs that share a server room

An IT operations team is measured on availability. Is the mail flowing, is the file share mounted, did the laptop get replaced the same day. Those are good things to be measured on, and a team that hits them is doing its job.

A security function is measured on something less comfortable: whether you would know, whether you could prove it, and whether you could recover. Those questions frequently argue against the thing that makes operations easier. Shared admin accounts make support faster. Allowing staff to install anything reduces tickets. Keeping a flat network means the printer always works. Every one of those is an operational win and a security loss, which is exactly why one person should not be scoring both sides.

What the 2026 breach numbers justify

Security spending arguments go better with real figures. IBM’s 2026 Cost of a Data Breach Report, published in late July 2026, put the global average cost of a breach at USD 4.99 million — up 12% on the previous year and the highest the report has recorded. The US average was far higher at USD 11.5 million.

The new finding in that edition is the AI one. IBM reported that one in four malicious breaches were AI-enabled, a 56% increase on the year before, and that those incidents cost roughly USD 6 million — about a million more than the overall average. The practical reading is not that attackers have magic. It is that the cheap, scalable parts of an attack — convincing phishing in fluent local language, faster reconnaissance, faster exploitation of a newly published vulnerability — got cheaper and faster.

Hold those numbers at the right distance. An average across large enterprises is not your bill. A twenty-person firm will not lose five million dollars. But the components of the cost — detection and escalation, lost business, notification, legal — scale down far less neatly than people assume, and a week of downtime is a week of downtime at any size.

Where attackers are actually getting in

The 2026 Verizon Data Breach Investigations Report contains the single most useful shift in priorities in years. For the first time in the report’s 19-year history, exploitation of vulnerabilities overtook stolen credentials as the most common way into a breach, at 31% of cases, with credential abuse down at 13%.

That reorders the to-do list. Patching stops being the boring hygiene task you get to after the exciting security tooling, and becomes the single highest-value control you own. It does not replace the credential work — the same report found 62% of breaches still involved the human element, and social engineering was the third most frequent pattern at 16% — but if you are choosing where the next ten hours go, they go into knowing what you run, knowing what version it is on, and shortening the gap between a patch being released and it being installed.

The framework that stops security being a shopping list

Without a structure, security purchasing becomes a list of products someone sold you. The NIST Cybersecurity Framework is the most widely used structure for avoiding that, and version 2.0 — released in February 2024 — is the one to use. NIST designed 2.0 deliberately for all audiences and organisation types, from the smallest non-profit upwards, rather than only critical infrastructure.

The headline change was adding Govern as a sixth function alongside Identify, Protect, Detect, Respond and Recover. That is not bureaucratic padding. It is the formal acknowledgement that someone has to own risk decisions, set the policy and hold the budget, and that without that the other five functions drift.

What it costs, honestly

Nobody publishes an honest price list for this, so here is the shape of it. The first tranche of security work is mostly configuration and discipline, not licences. Enforcing MFA on a mail platform you already pay for costs nothing but an afternoon and some internal irritation. Writing an asset inventory costs a few days. Documenting and testing a restore costs a day and tells you more about your resilience than any audit.

Costs start when you want detection and response outside working hours, or an independent assessment, or a certification a customer is demanding. Those are real line items and worth sequencing deliberately rather than buying in a panic after an incident. The order that wastes least money: fix the free things, inventory what you have, then buy the smallest service that covers the gap you have evidence for.

• Free or already paid for: MFA, disk encryption, automatic updates, log retention settings, least-privilege review, a written incident plan.
• Modest and high-value: a managed backup with immutable storage, vulnerability scanning, phishing simulation and training, a password manager for everyone.
• Genuine spend, needs a reason: managed detection and response, a formal penetration test, certification against a standard, cyber insurance with a real policy review.

Why hiring your way out of this is hard

You are not the only business that cannot find a security hire. The 2025 ISC2 Cybersecurity Workforce Study, based on more than 16,000 practitioners, found 59% reporting critical or significant skills shortages on their teams, up sharply from 44% the year before. A third of respondents — 33% — said their organisation simply lacked the resources to staff the team adequately, and 29% said they could not afford people with the skills they needed.

Two conclusions follow. First, if a well-funded enterprise is struggling to staff this, a forty-person firm planning to hire one person who does everything is planning to be disappointed. Second, the shortage being about skills rather than headcount means training your existing IT people is a legitimate strategy — many of the controls above are configuration work a competent systems administrator can learn.

In-house, partner, or both

The split that works for most businesses our size of client: keep ownership in-house, buy the specialist capability. Someone internal must own the risk decisions, because an external party cannot decide how much downtime your business can survive or which customer data matters most. Everything that needs either rare skills or 24-hour coverage is a candidate for buying.

Eudora works on the bought-in side of that table, and we work remotely. Everything we do — assessment, hardening, patch management, monitoring setup, documentation, training sessions — is delivered over the network to clients wherever they are, on their business hours. If what you need is somebody physically in your building in Sri Lanka, that is a different service and it lives at eudora.lk.

A ninety-day sequence for a business with no security function

1. Week 1-2: name the owner. One person accountable for security decisions, with a standing item at whatever your senior meeting is. This is the Govern function and it costs nothing but a decision.
2. Week 2-4: inventory. Every device, every cloud service, every account with admin rights, every system holding customer data. Expect surprises; everyone finds at least one forgotten service still live.
3. Week 4-6: MFA and privilege. Phishing-resistant MFA on email, remote access and anything internet-facing. Remove admin rights nobody can justify. Delete the accounts of people who left.
4. Week 6-8: patching. Agree a cadence, assign the owner, write down how an exception gets approved. Given that 31% of breaches now start with vulnerability exploitation, this is your highest-value fortnight.
5. Week 8-10: backups and a real restore. Restore something that matters, time it, write down the result. Confirm an attacker with your admin password cannot delete the backups.
6. Week 10-12: the one-page plan. Who decides, who calls the bank, the insurer, the customers. Where the contact list lives when email is down. Then walk through one scenario out loud with the people named in it.

What good looks like after a year

Not a certificate on the wall. A set of boring, verifiable facts: you can produce an accurate asset list in an hour, you can say when each system was last patched, every privileged account has a name attached, you restored from backup in the last quarter and know how long it took, and the people named in the incident plan have read it.

That is a realistic twelve-month target for a business with no security function today, and it addresses most of what the breach data points at. If you want help getting there, our services cover the assessment, the hardening work and the documentation, delivered remotely. Worth reading alongside this: in-house IT vs an IT partner for the staffing decision, digital transformation without the buzzwords for sequencing change without breaking things, and real-world cloud use cases if part of the answer is moving a system somewhere better managed than your current server.

Want a plain assessment of where your security actually stands, with a fix list in priority order? Get in touch with Eudora Technology to talk about your project.