Built Secure: what a managed security services provider in Minnesota should actually do

A breach does not just cost money, it costs momentum

Picture your business as a team on a winning streak. Every project shipped, every client won, that is momentum, and it is the most valuable thing you have. Now picture the one hit that ends a season in an afternoon. In sport it is an injury. In business it is a breach. Growth compounds, and so does damage. The ransom and the recovery are only the surface. Underneath sit the quiet killers: lost customers, a damaged reputation, and a team pulled off the work that drives the business.

Smaller does not mean safer. It often means targeted. Attackers go where the doors are easiest to open, and a growing company in Minneapolis or St. Paul holds valuable data without a full time security team watching it. PreVeil's 2025 research found 43% of all cyberattacks aim squarely at small businesses, 40% say a single six figure attack could end the business, and 88% of SMB breaches involved ransomware, versus 39% at large firms. IBM's 2026 edition moved the global average to $4.99 million and 247 days. The trend is not improving on its own.

A breach is a slow, quiet walk inside

Hollywood made hacking look like furious typing and a sudden ACCESS GRANTED. Reality is patient and ordinary. Most attacks follow the same five stages, and every stage is a chance to stop them, if you are watching.

1. The lureA convincing email, text or fake login page lands in an inbox. It looks routine: an invoice, a password reset, a note from the boss.
2. The clickSomeone clicks. Credentials are handed over, or a hidden payload installs. The attacker is inside, often without a single alarm.
3. The waitThe dangerous part. Intruders sit quietly, sometimes for weeks, mapping your network and finding the data worth stealing.
4. The moveThey escalate access, reach the crown jewels, and disable your backups so you cannot restore your way out.
5. The hitData is stolen, systems are locked, and a ransom demand appears. The damage is done and the clock is loud.

A 42 user accounting firm, a Solution Builders client, had an employee enter a password into a convincing fake Microsoft page. Identity monitoring flagged the unfamiliar sign in within minutes, the detection platform tied it to a new mailbox rule the attacker had created, and an analyst in the security operations center revoked the session. Containment took 22 minutes, no ransom was paid, and 100% of the data was recovered. The attack reached stage two and stopped.

Layered cybersecurity in Minneapolis: no single tool saves you, layers do

Picture your business as a fortress with rings of protection around what matters most. An attacker has to beat every ring. You only have to make one of them hold. That is defense in depth, and it is what a managed security services provider in Minnesota should be building, rather than selling you the ring with the best logo.

• Data and backups. The crown jewels, encrypted and recoverable. The innermost ring, the one that makes a bad day survivable.
• Endpoints, EDR and MDR. Every laptop, desktop and server watched 24/7, with someone who responds, not just a tool that alerts.
• Network and identity. Multifactor authentication everywhere, least privilege, and segmented access so a compromised printer cannot reach payroll.
• People and awareness. A trained team that does not take the bait.
• Testing and hardening. Finding the weak points before attackers do.

The endpoint ring is where proposals get confusing, because legacy antivirus, EDR and MDR all get called "endpoint protection." They are not the same thing.

EDR is the tool. MDR is the team. A company with 25 to 500 employees almost always needs both, which is why cybersecurity from Solution Builders runs on our own 24/7 security operations center in Bloomington rather than a reseller's dashboard. Someone is watching at 2 a.m. on a Saturday, and can act.

When prevention fails, the 3, 2, 1 backup rule is everything

Even the best defended business should plan to be hit. The difference between a bad week and a closed business is simple: can you restore clean data fast? The rule has not changed in decades because it works. Keep three copies of your data, on two different media types, with one copy stored off site. Add the modern requirement that one copy is immutable, so nobody with stolen admin rights can delete it. Sophos reported in 2025 that 97% of organizations with solid backups recovered their encrypted data, and 53% were back within a week.

The catch nobody talks about: having a backup is not the same as having a backup that works. Backups fail silently all the time, a full disk, a misconfiguration, a job that quietly stopped months ago. The only backup you can trust is one you have restored. Pixar learned that the hard way, in a story told in Ed Catmull's book Creativity, Inc. In late 1998, deep into production on Toy Story 2, the entire film lived on a shared studio server.

1. A single commandSomeone runs a delete on the wrong directory. On screen, the movie erases itself. First Woody's hat, then his boots, then Woody.
2. The gut punchEngineers yank the machine offline, but roughly 90% of the film is gone, and the backups had been quietly failing for about a month.
3. The accidental heroA technical director on leave with a new baby kept a full copy synced to a computer at her house. An off site backup, by accident.
4. Wrapped like a newbornThe team wraps her computer in blankets, drives it back to the studio, and the film is saved.

Pixar survived because, by accident, the 3, 2, 1 rule was in play. The real failure was the backup that ran for a month without anyone noticing. Do not find out yours are broken on the worst day of your life. Backup and disaster recovery from Solution Builders treats the restore test as a scheduled routine, and The SMB Cyber Resilience Playbook has a 30 day checklist that includes it.

Test it before they do: the maturity ladder

You do not know a wall holds until someone tries to break it. So try first. Threats change weekly, so testing cannot be a once a year box to tick. The strongest networks run a continuous loop: scan to map every weakness, exploit safely the way a real adversary would, remediate, then retest to prove the fix holds. Most damaging breaches walk in through a door already known to be weak, so testing flips the economics. You spend a little to find issues on a Tuesday instead of everything to survive a Friday night.

Testing also tells you where you stand. The maturity ladder has four levels, and most businesses sit at level 2 without knowing it. They bought the tools, so they feel covered. But owning a smoke detector is not the same as testing it.

• Level 1, Exposed. Basic antivirus, no monitoring, untested backups. Hope is the plan.
• Level 2, Reactive. Tools in place, but you only act after something breaks.
• Level 3, Proactive. Layered defense, 24/7 monitoring, regular testing.
• Level 4, Resilient. Continuous testing, trained people, tested recovery. You bend, you do not break.

The goal is to move up the ladder to resilient, where an incident is a manageable event, not an existential one. The same testing evidence does double duty for auditors, which is why regulatory compliance support at Solution Builders rides on the security program instead of running as a separate project.

Human firewall training in the Twin Cities: your people are the perimeter

The most advanced firewall in the world still cannot stop someone from clicking a convincing email. Attackers learned long ago that it is easier to fool a person than to defeat a system. According to the Verizon 2025 Data Breach Investigations Report, 60% of breaches involve a human action, a click, a reply, a mistake, and 16% begin with phishing as the first move. The median time to fall for a phishing email is under 60 seconds. The good news: the same people are your fastest, cheapest layer of defense once they know what to look for, and multifactor authentication blocks more than 90% of account attacks even when a password slips.

Awareness training is not a yearly video nobody watches. Done well, it is a steady drumbeat that rewires habits, and in a typical program the simulated click rate falls from the high twenties to low single digits over twelve months.

1. Teach the basicsShort, regular lessons on spotting fakes, building passwords and reporting anything odd.
2. Test with real luresSafe, simulated phishing that shows who clicks, with coaching instead of blame.
3. Track and improveClick rates fall month over month as habits stick.
4. Make it cultureReporting a suspicious email becomes a win, not an embarrassment.

For a 150 person company in the Twin Cities, that costs a few dollars per user each month. It is the highest return security you can buy.

Secure is not the goal, it is what frees you to move

A secure foundation makes compliance almost automatic, compliance protects your business, and a protected business is free to keep building momentum. One foundation covers many frameworks, CMMC, HIPAA, NIST, SOC 2, PCI DSS and GDPR among them, because the controls auditors ask for are the same rings described above. Here is the whole framework on one checklist.

• Layered endpoint protection: EDR or MDR on every device, watched around the clock.
• Multifactor authentication everywhere, the single cheapest block against stolen passwords.
• Tested 3, 2, 1 backups, with restores proven on a schedule and one immutable copy off site.
• 24/7 monitoring and response, so someone is watching while you are asleep.
• Regular testing: scans continuously, penetration tests a few times a year, simulations always on.
• Security awareness training that turns your people into a human firewall.
• Least privilege access, so people reach only what they actually need.
• A written incident plan, so everyone knows their role before the bad day.

Score yourself against the eight items. Three or fewer puts you at level 1 or 2 on the ladder. Six or more is proactive. All eight, tested, is resilient. If you want an outside read, Solution Builders designs cybersecurity from the ground up for Minnesota businesses, endpoints, detection, recovery, testing and the human firewall as one framework, from Bloomington with 50+ engineers and a SOC 2 Type II audited practice behind the security operations center. A free discovery session shows where you stand on the ladder and what to fix first.