The Unattended Moment: Cybersecurity for Organizations Without Security Teams

The Unattended Moment: Cybersecurity for Organizations Without Security Teams

On November 10, new federal requirements were scheduled to make third-party cybersecurity certification a condition for many defense contracts. That expansion has been suspended. But the question it raised remains: How much of a small organization's scarce defensive capacity should go toward proving security, and how much toward achieving it?

That question reaches well beyond defense contracting. Cybersecurity is getting better at helping security teams do their jobs. But what happens when there is no security team?

Listen to the industry and you will hear about agentic AI, autonomous security operations centers, advanced threat intelligence, and automated incident response. These are serious innovations. Each assumes an organization can supply money, expertise, and attention before that sophistication turns into protection. For a major bank or multinational corporation, that assumption holds. For a small manufacturer, municipal government, medical practice, or regional supplier, it often doesn't.

The ideas are not wrong. They are addressed to someone else.

We are advancing cybersecurity in ways much of the economy cannot afford to adopt or sustain. Cheaper versions of enterprise tools won't close that gap. Closing it requires a different understanding of what effective security costs to operate.

The Conversation Assumes Someone Is on Watch

The World Economic Forum's Global Cybersecurity Outlook 2026 found that smaller organizations were twice as likely as large ones to report insufficient cyber resilience. Some 46% of smaller organizations cited inadequate cybersecurity skills and expertise, compared with 29% of larger ones.

Britain's 2025/2026 Cyber Security Breaches Survey shows what that looks like in practice. Among microbusinesses, only 3% of respondents responsible for cybersecurity held an IT-specific role; usually, responsibility fell to an owner, chief executive, or other senior manager. Only 21% of microbusinesses had formal incident response plans, compared with 76% of large businesses.

This is a mismatch between the operating model our industry advances and the capacity of the organizations it hopes to protect. We build systems that collect evidence, identify anomalies, correlate telemetry, prioritize alerts, and open investigations. AI makes those processes faster and more efficient. But a finding is worth only what someone can do with it, and many smaller organizations have nobody dedicated to doing that work. The industry keeps making security operations more sophisticated while those organizations lack the capacity to operate security systems at that level.

Every security architecture makes an assumption about human availability. What matters most is what happens when that assumption fails.

The Cost of Proving Security

The Cybersecurity Maturity Model Certification program, or CMMC, makes the economic problem concrete. Protecting sensitive government information is essential. But for a small defense supplier, every dollar spent demonstrating compliance is a dollar unavailable for a direct security purpose.

In July 2026, the U.S. Small Business Administration estimated potential total compliance costs of approximately $593,800 per certification for a small defense contractor requiring third-party assessment, and $388,600 for one eligible for self-assessment. Those estimates include the underlying security requirements as well as compliance activities.

A narrower figure exposes the cost of verification itself. The Pentagon's 2024 CMMC regulatory analysis estimated approximately $101,752 for a small company's Level 2 third-party assessment process and initial affirmation, covering preparation, assessment participation, reporting, external assessor fees, and affirmation. The estimate assumed the required NIST cybersecurity controls were already implemented. The government's own model therefore places a six-figure price on verifying controls a small company is assumed to have already.

How much additional protection could that company purchase with the same money and management attention?

Certification has value. It establishes accountability and can expose real deficiencies. But that value should face the same scrutiny as any other defensive expenditure. What additional protection does the investment produce? What alternative security improvements does it displace?

On July 13, 2026, the Department of War (formerly the Department of Defense) suspended CMMC Phase II, which would have expanded third-party assessment requirements beginning November 10. Phase I self-assessment requirements remained in effect. The SBA warned that small suppliers were considering leaving the defense industrial base rather than absorb the compliance burden. A program intended to protect a critical supply chain risked driving participants out of it. The department's reform task force has since outlined options, including restarting Phase II for a narrower population within 90 days. Whatever form the program takes next, the underlying tension remains.

There is a deeper problem. A passing assessment establishes conformance with specified requirements. It does not establish how effectively those requirements constrain an adversary. Foundational controls remain essential, but attack techniques, speed, and scale are changing. Security requirements, and the evidence demanded to satisfy them, must continually justify their protective value.

When purchasing decisions revolve around what must be documented and certified, the more important question can be crowded out: What would make this organization demonstrably harder to compromise? For an organization with little capacity to spare, the difference can consume the entire security budget.

The Hidden Cost of Human Attention

The same economics extend beyond compliance. A security product's license is only the beginning. Someone must deploy it, configure it, maintain it, interpret what it reports, investigate findings, and decide when to act. A product priced at $10,000 annually can still be unaffordable to operate if it creates work requiring another employee, an expensive managed service, or attention existing staff cannot spare.

Managed security services have made sophisticated capabilities more accessible. But outsourcing a function does not outsource responsibility. Someone still has to understand the environment, define acceptable behavior, and ensure that security decisions translate into action. Acquiring a security capability and operating it are two very different costs.

Detection accuracy, time to detect, analyst productivity, and response speed are useful measures for organizations staffed to act on them. Where attention is scarce, another measure deserves equal weight: how much protection can be sustained without continuous human interpretation?

That question becomes urgent as adversaries automate. AI-enabled attack tooling is compressing the interval between reconnaissance, exploitation, and movement through compromised environments. Autonomous systems can attempt actions, interpret results, adjust, and continue without waiting for human direction. This is no longer hypothetical: in November 2025, Anthropic disclosed an espionage operation in which AI was used across the entire attack life cycle, from reconnaissance and exploitation to data exfiltration, as the World Economic Forum noted.

Even a well-staffed security operations center cannot guarantee that an analyst will recognize and interrupt an attack before it advances. For a smaller organization without dedicated security coverage, the disadvantage is greater.

The attacker operates continuously. The defender's attention is intermittent. That is the unattended moment.

A control that reliably prevents an unauthorized connection, constrains lateral movement, or enforces a defined boundary does its work when the adversary acts, without waiting for an analyst to recognize malicious behavior. Such controls still require sound configuration, maintenance, and validation. But their immediate protective effect does not depend on someone watching.

For an organization with limited staff, that distinction carries enormous economic weight. A technology that reduces the defender's workload can be worth more than one that merely makes the workload easier to perform.

Three Ways to Close the Gap

Sophisticated detection, threat intelligence, managed response, compliance frameworks, and AI-enabled operations all have a place. Their advancement cannot remain our only definition of cybersecurity progress. A security conversation that serves the whole economy should embrace three priorities.

1. Judge security by protective outcome and total operating cost. Ask what an attacker is prevented from doing, what evidence demonstrates that protection, and how much money, expertise, and attention it takes to sustain. Favor capabilities that require less specialist labor and generate less investigative work. Simplicity, predictable operation, and low maintenance are security innovations in their own right.

2. Design for the unattended moment. Assume attacks will arrive when nobody is reviewing alerts. Favor controls that enforce boundaries and restrict unauthorized activity without waiting for an analyst to recognize malicious behavior. Make protective action independent of a human's ability to respond in time.

3. Size compliance to its protective value. Keep the security objective clear, separate implementation costs from assurance costs, and test whether assessment requirements justify the resources they consume. Make standards responsive to changes in adversary capabilities. Shared defensive services and practical assistance deserve as much attention as documentation requirements.

For business leaders, the purchasing test comes down to four questions. What will this prevent? Who must keep it working? How much ongoing attention will it demand? And what happens when nobody is available to respond?

The Consequences Reach Beyond Small Organizations

Small organizations are woven throughout the digital economy. They manufacture components for defense programs, serve hospitals, support utilities, operate local government systems, and supply much larger enterprises. Their importance can far exceed their security budgets. An underfunded municipal network may support emergency communications for an entire region. A small supplier may be essential to a major defense program. A local service provider may hold trusted access to dozens of larger customers.

Attackers do not scale their capabilities to a defender's budget. A security model that smaller organizations cannot sustain creates vulnerabilities extending far beyond their own boundaries.

That raises a question for the entire cybersecurity economy. Does each additional dollar and hour spent on cybersecurity produce a meaningful increase in protection, or does some of that investment simply make an increasingly elaborate system possible to operate and certify? Well-funded organizations can absorb those inefficiencies. Smaller ones cannot.

Consider the Battle of the Atlantic. Allied convoys dramatically reduced the vulnerability of merchant shipping, but ships unable to maintain convoy speed, or forced to sail without escorts, faced far greater danger. Even escorted convoys remained vulnerable in the mid-Atlantic air gap, beyond the effective reach of land-based aircraft. German U-boats exploited that gap until long-range patrol aircraft, escort carriers, and increasingly effective antisubmarine tactics helped turn the battle in 1943. The lesson was larger than improving the defenses already in place. Protection had to reach the places where it was missing.

Cybersecurity faces the same strategic problem. Our industry has become exceptionally good at improving the capabilities available to well-resourced defenders, and that work must continue. But we should be equally concerned with the organizations those capabilities cannot economically reach.

The test of progress is not how sophisticated cybersecurity can become. It is how much effective protection the least-resourced organizations can deploy and sustain.