In times of economic uncertainty, budget cuts are a natural response. With high interest rates limiting borrowing, persistent inflation squeezing spending power, and continued layoffs shaking confidence in recovery, mid-market businesses are under mounting pressure to make tough choices.
For MSPs and IT consultants, this often means navigating difficult conversations with customers who seek to reduce spend, sometimes in areas that feel essential.
Often, the first cuts hit non-revenue-generating areas like cybersecurity. But pulling back just as cyber threats become more aggressive creates the perfect conditions for an attack. This means the cash your customers save today could lead to devastating losses tomorrow.
In fact, industry research showed that ransomware attacks frequently occurred in the aftermath of major corporate events, with nearly half (46%) following workforce reductions.
Instead of cutting blindly, providers must guide customers toward targeted investment in cyber resilience. That means helping them assess their current posture and making focused improvements that maximize protection without overspending.
Economic uncertainty is a magnet for cybercrime
Economic instability has always been fertile ground for cybercrime. During the 2008 recession, the FBI reported a surge in online crime. Similar spikes followed the pandemic downturn.
Phishing, ransomware and social engineering attacks all rise when times get tough. This is because shrinking budgets often mean shrinking security. Hackers see opportunity in weakened defenses and, in many cases, they’re under financial pressure too, motivating them to strike.
This is a critical point for MSPs. Cutting too deeply doesn’t just raise the risk of a breach. It also limits your customer’s ability to recover. Cyber insurance premiums can skyrocket or coverage may be denied entirely if minimum protections aren’t in place. Even a short-lived incident can cause weeks or months of disruption, including downtime, lost revenue, legal costs and reputational harm.
Even if your customers believe hackers have less to gain from their business than others, they still have plenty to lose. As attackers grow more sophisticated — leveraging AI, deepfakes and automation — the risk for unprepared organizations grows exponentially.
It’s not if, it’s when
Many small and midsized businesses still assume they’re too small to be a target. But nine out of 10 chief information security officers (CISOs) said their organizations face a material risk of a serious attack. Plus, nearly six out of 10 U.S. companies have been hit by ransomware in just the last year.
This false sense of security not only overlooks the risk; it amplifies it. Smaller businesses often don’t have the defenses in place to withstand an attack. They lack layered security, mature governance and dedicated cybersecurity team. So, when an incident happens, they’re unprepared.
This is where MSPs’ and IT advisors’ role becomes strategic. It’s important to assess how ready your customers will be when an attack happens.
Cyber resilience is a necessity, not a luxury. When the cost of prevention is almost always lower than the cost of a breach, now is the time to help your customers spend smarter.
Smart ways to invest in cybersecurity on a tight budget
Now that you’ve helped your customers assess their risks, identified their most critical systems, and established a response plan, the next step is to reduce their chances of an attack in the first place. That means making smart, prioritized cybersecurity investments.
When operating on a tight budget, it’s important to:
Prioritize risk-based spending
Not all vulnerabilities carry the same level of risk. Help your customers rank each one based on factors like:
- Scope. Is it tied to mission-critical systems or non-essential tools?
- Regulatory implications. What fines or penalties could apply?
- Operational disruption. How would it impact continuity?
Plotting these risks on a matrix can help your customers visualize and prioritize where it makes most sense to allocate limited resources based on the greatest potential business impact.
Invest in employee training
Your customer’s employees are both their first line of defense and their biggest potential vulnerability. No technical control can stop someone from clicking the wrong link or handing over credentials in a convincing scam. That’s why phishing and human error remain the most common entry points for attackers.
A strong security culture is built through training, not punishment. Counsel your clients to focus their efforts on:
- Teaching employees how to spot suspicious behavior, links or scams.
- Creating a safe environment and easy path for reporting mistakes.
- Ensuring everyone understands their role in protecting the organization. They should know why each of them plays a critical role in the cyber defense strategy.
The goal isn’t to eliminate human error. It is to reduce instances, minimize the impact and shorten your response time.
Leverage open-source and affordable tools
Cybersecurity doesn’t always have to mean expensive software licenses. There are reliable, community-supported open-source tools for monitoring, detection, endpoint protection and incident response. Many of these tools are built and maintained by security professionals and widely used.
An important caveat is that with open-source software, the tool is free, but the upkeep and implementation are not. They require planning and expertise. Make you advise your clients on tools that match both their team’s capabilities and IT environments so they can be configured correctly and securely.
Implement layered basic security controls
Some of the most effective tactics are also the most affordable. Layering simple protections across systems can significantly reduce your risks and vulnerabilities. Enable tools like:
- Multi-factor authentication (MFA), which blocks unauthorized logins
- Regular patching to fix known vulnerabilities before bad actors get a chance to exploit them
- Endpoint protection to detect and block malware or malicious/unusual behavior across devices.
These solutions aren’t flashy, but they work. Don’t overlook them because of their simplicity.
Michael Gray
Use managed security service providers
For mid-market companies, MSSPs offer a way to get enterprise-grade security without the overhead of building it all in-house.
Instead of shouldering the full cost of tools, staff and monitoring, your customers share those resources with other businesses. This lowers costs and improves protection, giving them access to 24/7 monitoring, expertise and incident-response capabilities.
If they have enough data to be an interesting target but not enough funding to fully secure it, MSSPs can be a lifesaver.
Review and maintain cyber insurance
No cybersecurity plan is complete without insurance. If your customers already have cyber coverage, encourage them to review policy details regularly. They may update as risks change, for example, to accommodate new risk factors like AI. It’s important to stay abreast of any changes and periodically review to ensure your coverage is up to date.
During this review, verify:
- Coverage limits still reflect current risk.
- All the policy requirements are met.
- Teams understand what is needed in the event of a claim.
Failure to meet policy requirements like MFA or employee training can void your coverage at the exact moment you need it. Don’t let it happen to you.
Closing thoughts
Cybersecurity is a strategic decision. For MSPs and IT consultants, it’s also an opportunity to strengthen your role as a trusted advisor.
By focusing on your customers’ biggest risks, using available resources wisely and building a culture of action, trust and resilience, even tight budgets can support strong protection. A well-structured cybersecurity strategy demonstrates business resilience you can help deliver.
Michael Gray is chief technology officer at Thrive.
Featured image: AyamJago — stock.adobe.com
