Solution Builders team
Jump to a section
- Hope is the cheapest plan today and the most expensive later: breaches that drag past 200 days cost 31% more, per IBM.
- Tools without people are expensive alarm clocks. Only 26% of critical known flaws got fully patched last year, per Verizon.
- One IT person cannot watch 168 hours a week. 78% of companies cut security staffing in half on weekends, when 52% of ransomware lands.
- Cyber insurance pays a claim after the fact. A managed security partner is the only option that checks every box.
The five cybersecurity options for small business, side by side
Somewhere in the Twin Cities right now, the owner of a 75 person company is looking at a security proposal and wondering whether any of it is necessary. The firewall is new. The IT person is good. The insurance renewed in June. And the numbers from Part 1 of this series, a $4.99 million average breach and 247 days to find one, still feel like somebody else's problem.
Every business handles cyber risk one of five ways, whether it chose to or not. Most companies with 25 to 500 employees are on option two or three and believe they are on option five. The table is our read of each option, based on the data in this series.
| Option | Stops attacks early | Watches 24/7 and responds | Recovers your data |
|---|---|---|---|
| Do nothing and hope | No | No | No |
| Buy tools and call it done | Partly | Alerts, nobody reading them | Partly, if backups exist |
| One IT person | Partly | Business hours only | Partly, rarely tested |
| Cyber insurance only | No | No | Pays for recovery, later |
| Managed security partner | Yes | Yes, 24/7 SOC | Yes, tested on a schedule |
Cost is the missing column. Hope and insurance are predictable right up until the claim. A managed partner is a fixed monthly fee, which is why finance teams like it more than they expect to.
Doing nothing, or buying security tools without monitoring
Option 1: do nothing and hope. "We are too small to be a target." It is the cheapest plan today and the most expensive one later. IBM's Cost of a Data Breach Report 2026 found that breaches contained in under 200 days cost an average of $4.32 million, and breaches that dragged past 200 days cost $5.65 million, 31% more. With nobody watching, nobody notices, and every breach drags.
Option 2: buy some tools and call it done. "We have antivirus and a firewall." This is where most companies in Minneapolis and St. Paul actually are. But tools throw alerts, and somebody still has to read them, patch what they find and act. The Verizon 2026 Data Breach Investigations Report found that only 26% of critical known flaws were fully patched, down from 38% in the 2025 report. IBM found that 53% of breached organizations had not encrypted their sensitive data.
Buying security tools without monitoring has a predictable ending. The endpoint agent flags a suspicious process at 11 p.m. on a Friday, the alert lands in a shared mailbox, and the first person to read it works for the forensics firm.
Tools without people are just very expensive alarm clocks.Part 2: The Alternatives
A lot to ask of one IT person, or one insurance policy
Option 3: leave it all to one IT person. "Our IT person handles it." We love IT people. They also sleep, take vacations and catch the flu. The Semperis Ransomware Holiday Risk Report 2025 found that 78% of companies cut security staffing by half or more on weekends and holidays, and 52% of organizations were hit by ransomware on a weekend or holiday. Attackers read calendars. One IT person cybersecurity is a math problem, not a talent problem: one person cannot cover 168 hours a week.
The fix is not replacing that person. It is putting a 24/7 security operations center behind them, which is what Co-Managed IT does: overnight monitoring, escalation depth and patching discipline, while strategy and priorities stay theirs.
Option 4: count on cyber insurance. "We are covered if something happens." Insurance is worth having. But a policy pays a claim after the attack, within limits. It does not stop the attack, shorten the 247 days or win back the client who left while you were down. Verizon put the median ransom at $139,875 in 2026, and 69% of victims refused to pay, so they still had to recover everything themselves. People frame it as cyber insurance vs managed security. It is not a choice. One prevents, the other pays.
Pays after the fact
- A check, weeks later, within limits
- Nobody watching the network
- Recovery is still your job
Prevents first, pays if needed
- Attacks caught in minutes, not months
- The controls your application promises
- Tested backups, so you never pay a ransom
Insurers now expect multifactor authentication, tested backups and endpoint detection, and contest claims when the application and reality differ. The questionnaire overlaps with the frameworks our regulatory compliance team works through with clients, so one set of evidence serves both.
Managed security services in Minneapolis: the option that checks every box
Option 5: work with a managed, layered security partner. People, process and tools working together around the clock, for one predictable monthly cost. It is the only option that does every job in the table, and it is where most companies with 25 to 500 employees land once they have lived through options one to four.
The data backs the model. IBM's 2026 report found that organizations using security AI and automation extensively had an average breach cost $1.93 million lower, and found and contained breaches 65 days faster. That is what a managed security operations center brings: platforms that correlate signals across devices, identities and email, and analysts who act on them at 2 a.m.
- People. A 24/7 security operations center with named analysts, not a dashboard someone checks on Monday.
- Process. Written response times, patching measured in days, backups restored on a calendar and reported to leadership.
- Tools. Multifactor authentication, endpoint detection and response, email security, immutable backups and identity monitoring, run as one system.
- Cost. A fixed monthly fee per user, which turns a terrifying unknown into a line item.
That is what managed security services from Solution Builders in Minneapolis mean in practice: our own 24/7 SOC in Bloomington, 50+ engineers, a SOC 2 Type II audit and month to month terms. A 42 user accounting firm client saw the difference when ransomware was contained in 22 minutes with zero ransom paid.
Five questions worth asking your team this week
You do not need a consultant to figure out which option you are really on. You need honest answers to five questions. Ask them at your next leadership meeting, out loud, and watch who looks at whom.
- If ransomware hit at 2 a.m. on a Saturday, who would know, and how?
- When did we last restore from a backup, for real, and how long did it take?
- Which accounts still do not have multifactor authentication turned on?
- How long do critical patches actually take to get installed, measured rather than guessed?
- Are we really doing everything our cyber insurance application says we do?
If any answer was "I am not sure," that is your starting point, and a better one than most. Part 3 of this series lays out the six layers that turn those answers into a yes, with the numbers behind each and what the first 90 days look like.
If you would rather talk it through, a free discovery session with a Solution Builders security architect takes 30 minutes and ends with a plan. We have had that conversation with Minnesota companies since 1995, and the one answer we never give is "you are too small to worry about it."
Cyber risk strategy for Twin Cities companies
From our headquarters in Bloomington, Solution Builders has helped Minnesota companies choose a cyber risk strategy that holds since 1995. Our 24/7 security operations center, 50+ engineers and SOC 2 Type II audited practice back companies with 25 to 500 employees across Minneapolis, St. Paul and the I-494 corridor, whether they bring an internal IT lead or hand the whole thing to us. Related services: Cybersecurity, Co-Managed IT, Regulatory Compliance. Contact us or book a 30 minute call.
