Should small business whine? This is how Seth Godin titled his very telling blog post this morning. No- they should not. Small businesses have every reason in the world to out preform any large company with a bit of common sense and a personal touch. When I remodeled my house, I tried to buy almost everything I could online, mainly from small businesses. In one stressful day the plumber came to install all the faucets and discovered we got the wrong part. He wanted a replacement by the end of the next day, so he can install it on time before he leaves to his summer vacation. I emailed the company I bought the item from (small business out of Louisiana) and few minutes later I got a tracking number for an next day air shipment of the right piece. No excuses, no whining- amazing service by one committed business. I ended up buying all other plumbing materials from them. Investing in personal customer service is your safest bet- you are either the boss or close to her, there is no bureaucracy and decisions can be made in minutes. In addition, you can use some of the rules I published last year that will help you appear large and professional. Look as professional as Amazon but with a better/faster/personal customer service can be your ultimate competitive weapon.

• Presence: save on coffee, dining out or anything else but don’t save on your public presence. Glossy product brochures and a shiny website are essential to look impressive (Seth Godin just published a useful guide on how to create a good enough website). Make sure you hire a good marketing agency (there are many small firms of young and smart guys that will make you look brilliant). This is one of the areas where quantity doesn’t count as much as quality. I know many people don’t think it is important–but trust me, it is as bad as coming to a sales meeting unshaved and in your DYI outfit.
• Use technology to appear bigger–there are many products that will make you look big. Here are some examples: use Ring Central for telephony–you can manage the system to do just about anything, including dialing 3 for Jack who works in the office in California and 4 for Jill who works out of her home in Minnesota. Another technology that can increase your slickness index is a contract management system like Echo Sign. It is not a must if you don’t get contracts by the hundreds, but for a very small fee you appear to be large and organized, and people tend to negotiate less when facing an electronic contract. Do you run webinars? It is so easy to do and there are many technologies for that like Webex. You can even record them: have a professional narrator do voice over for a few hundred dollars and you’ve got yourself impressive e-learning on the spot. There are more, but you get the point–with many of these tools offered as a service, you can move quickly and get a better customer who is facing technologies than the large competition that will spend years to decide on each project.
• Get a CRM system- more than anything else, small businesses can differentiate on service. Get a good CRM system and make it part of your culture to use it. Connect it to the telephony system so you can get your caller info on the screen before they even say hello.
• Add some big names to your customer list–Go out of your way to get some recognized names as customers and even better, get them to endorse you. It may not be important revenue wise, but it will add credibility. By the way, you can do the same with partners as well.
• Be consistent–maybe the most important tip–be consistent with everything you do that faces customers. There is nothing less consistent than 3 people showing for a meeting with a potential customer with 3 different types of business cards, giving 2 different brochures designed with different look and feel and slightly different logo. This is not saving, it is losing potential customers. Get someone to build a good master template and use it everywhere. And yes, toss away the stuff you printed last year. You did the same with yesterday’s paper…

I am in an iPhone mood. Just like the rest of the world. It will go away, I promise. Last week I tried to answer a more fundamental question: Should you build an iPhone app? Now that you built one: how would you price your iPhone application?

Here are some interesting statistics: based on Tech Crunch’s mid day iPhone App Store download statistics from Friday, the top 10 free apps had a total of 68,452 downloads where the paid ones (mainly games) got a total of 4,484 downloads. It means that only 1 of 15 downloaded app was a paid one. I suspect the overall numbers are even lower. Why? The ratio between the number one paid app (Monkey Ball) and the number one free app (Remote) is about 1 paid to 9 unpaid. If you look at the last apps in the top ten list the ratio is now 1 to 25- which means that the longer the tail is, the more unlikely you are to make money on your app.

So what? It is clear that people prefer free for paid. As I mentioned in a previous post, a chapter in Dan Ariely’s book, Predictably Irrational is dedicated just for that. According to Ariely, when people were presented with two options, one free and the other not, they always selected free, even if it meant getting a lesser product. Dan even tried to minimize the disturbance of paying by adding the Lindt truffle to your lunch check but people still preferred free. Get this, when Hershey kiss was priced for 1 cent and Lindt for 15 cents, people picked Lindt in a ratio bigger than 2:1. When Hershy was offered for free and Lindt for 14 cents (same 14 cent difference) people selected Hershey in 2:1 ratio. This is how powerful free is.

So, according to this tested human behavior, people would always rather getting their apps for free, even if the priceis going to be very low. Nevertheless, experts anticipated that it will be different with the iPhone app store since Apple already proved that it could educate the market to pay for songs and movies instead of stealing them. In my opinion, it worked because it was easier to click buy now and pay 99 cents than going to your favorite file sharing site, look for the song, take 10 minutes to download it and import it to iTunes (and felt bad throughout the process…) . The tight integration made buying a song a no brainer.

But when customers will face two options: tightly integrated free app or tightly integrated paid app, both offer the same download experience - the first day statistics and Ariely’s research indicate that the vast majority will go for the free option, even if they will get a lesser app.

What does it mean? unless you are sure you can produce a massive hit, go for a free option and build a loyal install base you can market to in the future. Since the cost of development is so low and there is no distribution friction, most developers should seriously consider the free route and find a way to monetize the application based on something else (user data, commerce options etc). If you do price your app, be very careful with a low fee- it seems like one dollar apps will be way less popular than the free ones but will get little revenue. With a special enough application, that solves a unique problem of a relevant target market you may be able to charge enough and make it work for all sides.

Now, I may be completely wrong- Apple proved smarter people than me wrong in the past. Even in this case I would still suggest following the trends in the store, reading Dan’s book or the research paper and make sure you put a lot of thought into your pricing startegy. Good luck.

Update July 15: As posted in Tech Crunch today, there is a trend of increased number of paid application compared to free. The statistics refer only to the total number of applications and not to the number of downloads/popularity but they reflect on the fact that developers are optimistic about their ability to generate revenue selling apps. Jury is out…

There is an incredible amount of buzz surrounding the launch of the iPhone app store today. You walk around University Ave. in Palo Alto, CA and it sounds like everyone is building an iPhone app… Before you had out and build one for yourself, here are some things to remember:

• Watch the numbers- Apple is hoping to ship 10-12 million iphones this year. This is 1% of the total estimated phones shipments this year. When compared to the total number of phones in the world (3.3 billions), the share is even smaller. If your success rely on mass penetration, go look elsewhere.
• Ignore the numbers- large numbers are only part of marketing. Relevant numbers are as important. The iphone user group is small but very homogeneous, which creates limitless opportunities for the right application. With bunch of educated, urban and early adopters carrying iPhones with them, applications like social networks, sophisticated games, travel related apps and other cutting edge products can thrive. Density over size can be a winner in this case.
• Remember App Exchange- When Salesforce.com launched AppEx software developers were psyched.  After years of one by one hunting of the big guys customers (Oracle, SAP etc), they were offered with a marketplace were SFDC customers could browse, test and buy great complementary applications. Couple of years later many say that AppEx yielded limited results and many partners admit they expected much more out of this channel. Not enough SFDC customers proactively searched for a solution and ISVs needed to invest in sales and marketing to get to SFDC customers, just like they did before with the traditional on premise software.
• Forget App Exchange- while similar, iPhone app store has some meaningful advantages:
  • Each iPhone user is an individual consumer with full purchase decision rights (unlike SFDC business users that can not buy IT on their own in most cases)
  • iPhone store will be a great place to kill 10 minutes waiting for say, check in to a flight. With no new e-mails and few minutes to spare, many apps will be purchased out of boredom.
  • iPhone apps are cheap- with most apps cost less than $10, the decision to buy one will be simple and in many cases, irrational. No business app is bought this way.
• Don’t get lost- people, contrary to common belief, are reactive creatures. There are already 500 applications in iphone app store and the number will grow every minute. In just few hours the top paid app got as many as 1800 downloads. Don’t rely on people browsing for your app- make sure it is viral, invest in getting the best reviews and don’t forget that there are no free meals- you still have to invest in marketing, PR and business development to get customers’ attention.
• Don’t launch just because you can- Apple made it very easy to create and sell an iPhone app. It will lead to many low quality applications, developed by amateurs. While you can think of an app today and release it before the month ends, don’t do it. Plan it, QA it, beta test it and make sure it is good before it is out. iPhone app store will form a community of users and communities have long collective memory…

Next: Should you give your iPhone app for free?

In his fascinating book, Predictably Irrational, Dan Ariely describes the lure of the zero priced item. Dan provides examples from the real life: in his experiments, people selected Lindt truffles for 30 cents over Hershey kisses for 3 cents, but when given a choice, preferred a now free Hershey kiss over 27 cents truffle. The conclusion from this experiment and many other is clear: we love free.
No other place as the Silicon Valley has ever produced more free stuff: we have a free search, free reviews, free price comparison and free web conferencing. Almost everything is offered for free, in an attempt to win us over and break our old paying habits. In a rational world, we would have carefully considered the benefits of each option and select the best for us, no matter if it is free or not. In Ariely’s predictably irrational world, we will always go for the free option.
Nevertheless, the business software world is not acting this way. The fact it is near free to produce more units (e.g. more users) in the Internet world led to the creation of hundreds of free services (many targeting SMBs), competing with the traditional, priced services. Take Webex: Cisco believed that its web conferencing money machine worth snapping and paid over 3 billion dollars for the pleasure. Webex sales an expensive web conferencing tool and doing fairly well, thank you for asking. Vyew on the other hand, offers similar capabilities for free with ads or for a tiny amount with no ads and only achieved marginal success.
It got me wondering… laterI got to what I assume is the answer: Joe the consumer loves free. Joe the CEO hates free. The fact that Joe constantly switches roles is confusing and this is what led so many companies to offer business services for free. Joe will happily surf Facebook for free (and will most probably never log in again if Facebook come up with even a nominal fee of $1/month) but would resent using a free service for project management, CRM or web conferencing, typically used for the most important business engagement : customer calls.
So why not using free? Ask Joe, but I suppose that the following reasons are among the ones you will hear from him:

• Perceived value: free offering creates a low perceived value. In a business setting, we tend to assume that everything we buy or use is there to create revenue so a perceived low value service might contradict this belief.

• No throat to choke: reliability is more important than money in the business world and free service providers are perceived to be less accountable. We are all afraid to get the “you paid nothing, I owe you nothing”. (Take Grand Central for instance: this free Google service was down a couple of times in the recent weeks and for hours users couldn’t even get to a web page that will provide information regarding a fix, not to mention getting someone on the phone)

• We don’t like surprises. Wearing our business hat we like them even less. When paying for a service we assume consistency (if I paid $30 a month for X, I assume getting at least X next year). With free services they can always add ads, change the plan and make us regret the moment we started using the service.

So? For small businesses, I do recommend using free services. Let them run for a while, check their reliability and pick services that are non mission critical to the business, and will not require major overhaul if something goes wrong. Continuing with the Vyew example, you can always start by using it for internal meetings before using it for sales calls. If you are a startup and about to launch your free service, think twice. There are cases where free can lead to faster adoption but many others that not. Once you offered something for free, there is usually no way back and your perceived value will always be low.

Last week I wrote about measuring customer satisfaction using only one powerful question. Between then and now I was approached by two companies to gauge mine: Netflix and Telenav. I like both services a lot but Netflix proves time and again that they have mastered the web 2.0 techniques of measuring satisfaction and performance whileTelenav looks like it outsourced customer engagement to an agency from the 90s…

Netflix mastered the idea of getting a lot of information by asking one question at a time, and make it very easy to answer. See how Netflix measures speed of delivery: One question, embedded in an e-mail so you don’t even have to follow a link in order to respond. I have no data about the response rate for Netflix surveys but it must be very high given the extreme ease of use.

Telenav already disappointed me in the past and last week it did it again. The company sent me a 282 words long mail that asked me to participate in a short 5-7 minutes survey. The survey page took me to a landing page (250 words if you want to know…), now asking for 10 minutes of my time. The survey presented hundreds of questions, many of them had little relevance and many others were so obvious that wasting users time on answering them seems like an insult (e.g. from 1–5, how important is the fact that your GPS is always reliable? How many users you know that are actually OK with getting to the wrong address??? or the importance of getting audio directions when needed (before the next turn)- What did you think? that I like my directions after I passed the turn??)

I am sure that Telenav got little response, confusing results (how many people will seriously think of good answers for hundreds of questions for a chance to win $50?) and did not learn much at the end. It also did not learn what really bothers me  (service uptime in this case ) and did not solicit any new good idea.

So for your company survey: how about asking one simple questions that really matters at a time?

We all know that companies that offer superb customer experience and enjoy high customer satisfaction are more successful and competitive in the long run. Often when I meet managers in for Small and Medium Businesses (SMB) companies, I hear that they are convinced that their customers love them. When I ask for a “proof,” they say that they just know it: they don’t need to measure it since they talk with their customers all the time. When I dig more, I usually discover that they think that measuring customer satisfaction is too hard and expensive for a small company. In this post I will try to offer an easy way to measure and compare customer satisfaction for SMB companies.

Why measure? You should measure customer satisfaction for the same reason you measure sales. When you want a number to go up you ought to measure it so you can establish a baseline and a way to measure the impact of business strategy on customer satisfaction. Imagine investing in marketing without checking the sales impact, and you will get the idea.

What to measure? You can measure individual transactions (rate your satisfaction from support at the end of a call), measure a specific product or measure the overall experience from a company. When measuring a transaction, the results are often used to measure consistency of delivery, while measuring the overall experience can provide a more holistic and strategic insight about your efforts and allow comparing your company to other companies.

How to measure? There are many companies that specialize in measuring customer satisfaction and provide benchmarks to other companies. Companies like TNS, for example, benefit from having a huge database of companies they serve. This means they can easily provide a good comparison between your results and other companies at your size or industry. The issue is that the cost and complexity makes this process unattractive to most SMBs.

How to measure with ease? The simplest and most effective way I know is called The Net Promoter Score (NPS). It is super simple, allows a readily available benchmark, and you can even do it yourself if you like. Since it requires asking only one question, you can easily call, mail or otherwise communicate with your customers to get the answer.

What is Net Promoter Score? NPS is a simple way of measuring customer satisfaction by asking one question: “On a scale of one to ten, how likely is it that you would recommend us to a friend or colleague?” The difference comes in the way the results are analyzed. Regularly, you would either average the results or try to show a fancy pie chart with the percentage for each answer. With NPS, you use a different method:

you sum up the ones that answered 9 or 10. They are called Promoters. These customers are likely to go out there and promote you with or without your request. Then you take the ones that gave you a 6 and below and sum their number up. They are called Detractors. They are likely to go out there and say bad things about you. To get your NPS score you need to simply subtract the detractors from the promoters. By the way, I did not forget the ones that gave you 8 or 7, the passives. We ignore them because we assume that they would not say anything good or bad about you. This is the whole idea behind NPS—Your biggest supporters minus your worst detractors equal your word of mouth power. 

Can you give me an example? Yep—here goes: say you got the following results:

The NPS score will be 30% [(30%+20%)-(10%+5%+5%)], which is fairly high. It puts you below NPS stars like eBay, Costco and Apple but above the average company that will score between 5% -10% and bad companies that will have a negative score.

What to do with the number? One paragraph cannot provide a sufficient answer for this question, but here is the overall direction:

• · High score (30% and up)—you have a treasure in your hands. Think of programs that can leverage it like reference program or customer generated content on your website.

• · Average score (0%-30%)—While not an emergency, you should think of ways to improve the overall score by providing better service and products.

• · Low score (any negative number)—you have a time bomb in your hands. More people out there are saying bad things about your business than there are people saying good things. This calls for special measures like companywide customer satisfaction efforts and specific intervention programs with the most problematic customers.

Most importantly, you have to come back and measure NPS every year or even twice a year, so you can evaluate your success in increasing your score and discover early warning signs before they turn into catastrophes.

Gadi Shamia

I am often asked about strategy, execution and the relationship between them, and I ended up explaining the issue in an e-mail today. After reading the e-mail again, I figured it was generic enough to be widely shared, so here goes…

Rule # 1- No need for “VP of Strategy”: strategy is so well embedded in the organization operating system that outsourcing it to a VP of strategy is hardly ever a good idea. The rationale is clear: when you are not making/selling/marketing anything, your strategic ideas will dwindle or become disconnected from the company reality. Say you promoted your bright director of product marketing to be the VP of strategy—sooner or later she will lose the source of inspiration she had, which was the constant work with customers and partners and the actual creation of the product and will not be able to impact strategy as she did before.

Rule # 2- Strategy is the business of the CEO:just as a division commander in the army doesn’t employ a “strategy officer” and is responsible for the division strategy, a CEO needs to be the one creating and executing the company strategy. He or she can include other executives to contribute to the process but should never outsource it all together to anyone in the company.

Rule # 3- Strategy is not for everyone: While devising a strategy is not a talent that one gets with the VP title, strategy should not become a companywide process. The VP of marketing can and should come up with the company marketing strategy, derived from the company overall strategy, but please don’t ask a manager in the support department to come up with the first level support strategy. The best he should do is to create support tactics based on the company strategy. For example, if your company strategy is to win customers by offering the best customer experience in the market, your first level support manager can insist in answering any call within 15 seconds and making sure that every support call translates into a positive experience. 

Rule # 4- Add strategy to each process: with one simple question you can turn every important process in the company into a strategic process. The question is: “how does it support our strategy?”. Here is an example: your CFO submitted the first draft of the budget for H2/2008. The draft calls for a 15% budget cut across all departments. Ask the question and you will discover that the CFO simply reduced costs by 15% to align costs with the plunging dollar and the plummeted housing market but forgot that your strategy was to win customers with the best customer experience. The new budget based on this strategy may cut 30% in marketing, in hopes that word of mouth will do the trick, and increase service and support budget by 20% and R&D in 10%. While it sounds trivial, start asking the question often and you will discover that (1) not everyone understands the strategy and (2) even fewer are taking it into account in planning.

Rule # 5- The strategy process never stops: this may be the most important one. I know that there are some people who say “now is the time for execution, not for strategy”. I claim that there is always a mix between the two; sometimes you invest more in the strategy process and sometimes more on execution. Say you just spent a week offsite, building a rock solid strategy. You still need to (a) keep validating it every time you have a chance to meet with a customer, analysts or anybody with a brain… (b) tweak it if needed. If your strategy is good, you usually only need to change tactics, and not the strategy itself, and (c) the most complicated task: make sure that execution is aligned with strategy.

Definitions:

Strategy is a long-term plan of action designed to achieve a particular goal, most often “winning.” Strategies are more stable in nature and don’t change often.

Tactics are the detailed maneuvers to achieve objectives set by strategy, which means they can often change as long as the underlying strategy stays the same.

Last week I wrote the first part of the Is SaaS for me post. It talked about two important distinctions of the SaaS model: It changes the power play between the customer and the vendor and assures that the vendors work for the customers every day. This part will cover some more distinctions like simplicity, security and maintenance.

It is so much simpler: another thing that works for SaaS product is their age. The good SaaS vintage (1999-2000) is now eight years old. It means that it offers a perfect balance between maturity and cleanness. You may not believe it but your typical enterprise software is 20-25 years old. They were designed before the Internet, before Google and sometimes before the age of robust local area networks. With slower development cycles (Didn’t it take Microsoft 6 years to release the premature Vista?) and many unneeded features added during the years, they tend to be too much on some areas (good luck finding why the setup screen of your product has 750 settings…) and too little on others (should I ask again how come MS-Outlook never embedded a Plaxo like service and can’t tell me that Jane is in the UK right now before I call her at 3:00AM in the morning??).

You really , but really don’t have to maintain it: here is a typical scenario: you bought a product, paid for it and even paid for support. Two years later comes an upgrade. You run among all the users, make them log off, insert the CD, run the installer, upgrade the data, reboot the server and poof, it just doesn’t perform as it used to. 4 hours (or 14…) later you and the friendly support guy discover that the new version encrypts the data but you run an old version of the database that doesn’t support that encryption. Next time you will surely replicate the server, install a test machine and run some testing before risking your production system (and spend three working days in the process). Choose SaaS and the little dwarfs will do all the testing and then one night upgrade every customer, and you will log in from your browser like nothing ever happened.

Let’s talk security: A few years ago I heard SMB customers saying: “I will never let my customer data out of my business”. Working in an IT security company I now discover how vulnerable SMBs are when it comes to security and how little they invest in an overall security plan. I challenge every SMB to run a vulnerability scan once on their network and get the real picture (shoot me an e-mail, I can arrange one for you…). Three people in IT cannot install networks, fix servers, install Office, configure laptops, setup telephony and at the same time configure firewalls, react to never stopping IDS alerts, scan and fix vulnerabilities and enforce policies. By moving to SaaS you actually create a positive chain reaction: by moving one application to SaaS you achieve an immediate security enhancement by letting the pros protect your data. Now your overworked IT department can spend some quality time on security and better protect your internal assets so you get double the security with the same effort.

Now, I am not saying that every SaaS product is great and every on-premise product is antiquated. I am merely suggesting that you should seriously go through this list (which is not full and exhaustive) and ask yourself if the above is important to you. If the answer was yes, the SaaS model excels in all of the above and now you are down to finding the right product for your business.

Think differently? Think the same? Comment please. This is the lifeblood of the blogger…

PS—I had to add it… talking about how updated the on-premise products are, did you know that Office 2008 for Mac, released on January 15^th 2008, still highlights “blog” as a misspelled word???

People write a lot about SaaS and focus on the famous “no-software” phrase that Marc Benioff coined. What many people fail to discuss is that the SaaS model, even if one ignores the products themselves, brings real value to customers and puts them in the driver’s seat for the first time. So for once, let’s not talk about technology or delivery mechanisms, but rather focus on the change in the most basic rules of the game that the SaaS revolution is creating, with or without a planning hand from the SaaS companies side. Most of this change is affecting my favorite segment, the Small and medium businesses (SMBs), so let’s talk about how SaaS impacts the way SMBs treat IT.

It changes the power play: SMBs were always in an unfavorable situation: most of the software companies they interacted with were larger than them. Larger as in Mammoth and a penguin, not as in Magic Johnson and yours truly… IBM, SAP, Oracle, Microsoft, Symantec, McAfee… want more? How does it feel to be a 100-employee (or 1000 employee for that matter) business, negotiating and buying from a 100,000-employee enterprise? Because SaaS is so disrupting, virtually every SaaS company (Salesforce.com excluded) is still an SMB. Even Netsuite, with 100M in revenue, still cares dearly for a $50,000 a year deal and will go hand in hand with the customer to get the deal sealed. Don’t you miss buying from companies that ring the bell when they get your business? You may think it is a temporary advantage? You are right, but read the created natural checks and balances below.

SaaS companies need to earn your business again, and again, and again… When was the last time you felt that all your vendor wanted was to get the deal and forget about you? To be perfectly fair, it doesn’t happen because evil people go to work for large software companies, and the pure in heart find the way to SaaS companies. It happened because you wrote a check in advance for a product which is always more art than science. Let’s do the numbers: you paid $50,000 for a software product. Here is how your vendor looks at your business: Day one: $50,000; from day two to day 1825 (assuming you will keep the product for at least 5 years): about $20,000 more, assuming the average customer will sign up for support for about half of this period.
Now let’s evaluate how a SaaS vendor looks at the same customer (assuming $15,000 a year): Year one, 15,000; Year two: 15,000; year three… you got the point. For SaaS vendors the first year (and in many cases the second as well) means pure loss and a negative cash flow. If a SaaS vendor cannot keep its customers for at least five years, they may as well flip belly up now and save the sweat and tears.
How do you keep customers for five years and more? You make them happy. Every day. Very happy. Jack Welch said once: “you don’t get what you expect, you get what you inspect. We all expect that our vendors will treat us well even if we paid 70% in advance, but in reality, enterprise businesses are measured on the first transaction and this is where they aim.

Disclaimer: being perfectly fair, Intuit and Adobe proved that you could be an on-premise vendor and score high on customer satisfaction. The reason is the tiny size of the initial transactions they get from their customers, so upgrades for additional services act like renewals. When you sell a $150 package, you are doomed if you don’t get your customers to buy additional services from you and upgrade every three years.

Continue to Part 2…

I am not claiming to be a network security expert, but here is a trend: while SMBs consistently place network security as their number one IT priority (Gartner SMB IT survey is only one example), many CEOs have “outsourced” the issue to their overworked IT departments, assuming that they will know what to do. As a CEO/CFO or any other C-level executive, there are some questions you should ask yourself about your network security and about the assets you actually protect.
What is the business impact of network security breaches? Actually, I can’t answer this question for you without knowing your business. What I do know is that there is something you want to protect. It can be as simple as a customer list with all the data you have accumulated on their buying habits, it can be your financials, it can be the specs of your new product or your customers’ credit card data. The business damage can be loss of customers, loss of credibility or even lawsuits from customers whose data got exposed.

But why do C-level executives need to be involved? Network security is a subset of the network, and this is why you pay your IT director, isn’t it? His team created the network to begin with, so they can keep it secure. This perception can change if you spend few hours with your IT staff. The average IT department is constantly putting out fires: between user questions, software installations, patches updates, laptop configuration and more, they just don’t have time to think and plan ahead. They also suffer from…you. When they come to you with projects that are not urgent, you usually find a way to convince them that it is not that important.
What’s the pitfall in network security? Many C-level executives in SMB companies apply the physical security theories on network security: I have a modest house, why would anyone steal from me? In reality, hackers don’t care if you are big or small or if you protect your 35M of annual revenue or the 350B of Wal-Mart. Unlike the physical world, they are not limited by geography or even capacity: they can attack anyone in the world and try thousands of times a day, so instead of “studying the neighborhood before they act” they just hit the entire city and enter any unlocked door.
The vulnerabilities in your network are like signs calling to hackers to try them out—and trust them, they will. Just like insurance, you can’t wait for the damage to happen and buy it after the fact. You have to assess your level of risk and get the right level protection.