Your SMB Cyber Quote Is Probably 3× Too Big

Most cybersecurity proposals SMBs receive recommend eight or nine products. A right-sized program needs four — sometimes three. I’ll show you which ones, anchored to what your business actually does, and why the typical quote covers things you do not need. If your current proposal already lines up, you will know that too. Either way, you will stop being sold by feel.

The quote you got recommends eight things. You probably need four.

A typical managed-service-provider proposal for a 50-person professional-services firm includes: a SIEM, a SOC retainer, endpoint detection and response, a mobile-device-management platform, a single-sign-on licence, a privileged-access broker, a vulnerability scanner, an awareness platform, a fractional Chief Information Security Officer add-on, and frequently a code-security scanner — even if the firm has never written a line of code.

The bundle is not malice. Vendors and resellers earn on volume of licences, not on outcomes. Margin lives in the third tool you add, not the first. So the proposal always trends toward “you might be missing this” rather than “you definitely do not need that.”

The way out is to stop asking how much to spend and start asking what you are protecting. Once that question is answered, the right stack assembles itself — and it is much smaller than the quote in your inbox.

What you are actually protecting (the six asset classes)

Strip away the vendor framing and there are six things any SMB needs to defend:

Identities. Every login your staff, contractors, and tools use. The single biggest blast radius in any incident.
Servers. Anything you operate — cloud instances, on-prem boxes, container hosts. If you only use SaaS apps (Microsoft 365, Google Workspace, Slack), you do not have this asset.
Privileged access paths. SSH, kubectl, database admin, RDP. The mechanism by which one stolen laptop becomes one compromised production environment.
Endpoints. Laptops, developer machines, phones. Both as targets and as forensic witnesses to what happened.
Source code. Only if you ship software your customers use, or even internal tools. If you do not write code, this row is blank — and a code scanner has nothing to scan.
Compliance evidence. The audit trail that satisfies a SOC 2 review, a HIPAA audit, or a cyber-insurance carrier checklist.

A right-sized stack covers every asset class that applies to your business and nothing else. If row six is blank for you, that is two products you do not buy. If row three is blank because you are SaaS-only, that is another. The shape of your business decides the shape of the stack — not the vendor’s catalogue.

The six open-source services that cover real SMB needs

ThinSky operationalises six open-source projects as managed services. They were not chosen by accident — each one maps to exactly one of the asset classes above, and the projects themselves are battle-tested at far larger scales than any SMB will ever throw at them.

Keycloak — Identity, single sign-on, and multi-factor enforcement. Self-hosted, no per-seat charge. The first service to deploy if your team is still juggling per-app passwords. The service to skip if you already have Okta or Entra ID and the renewal is not crippling you — the Keycloak vs Okta comparison walks through when it does make sense to switch. Asset class: identities.

Wazuh — Log centralisation, threat detection, and the audit-evidence trail your compliance framework expects. The first thing an auditor asks for when they want to verify “you monitor your environment.” Replaces the bundled SIEM-plus-SOC-retainer line in most proposals at a fraction of the cost. Asset class: servers + compliance.

Teleport — Privileged-access broker. Every SSH, kubectl, and database session brokered with short-lived certificates, recorded for audit, and gated by multi-factor. Removes standing access — the class of bug that turns “compromised laptop” into “compromised production.” Asset class: privileged paths.

Velociraptor — Endpoint visibility and DFIR (digital-forensics-and-incident-response) readiness. Stays quiet until you need it. When something happens, you get hours-of-investigation answers in minutes. The single best insurance policy against a million-dollar ransomware event. Asset class: endpoints.

OpenVAS — Continuous vulnerability scanning across servers and network gear. The report SOC 2, ISO 27001, and most cyber-insurance carriers explicitly require. Asset class: servers + compliance.

SonarQube — Source-code security scanning in the build pipeline. Catches SQL injection, hard-coded secrets, unsafe deserialisation — the usual classes — before they ship to customers. Asset class: source code, when you have it.

That is the whole list. No commercial substitute is named because vendor markets shift every eighteen months; the open-source projects above have not moved in years.

The decision tree, in plain English

The recommender on this site does this in eight questions, but the logic is small enough to walk through manually:

If you ship production code: SonarQube. If you only write internal tools, it is still useful but defer-able. If you do not write code at all, do not let anyone sell you a code scanner. There is nothing for it to scan.
If you operate any servers: Wazuh for logs and detection. OpenVAS for the patch surface. If you also carry compliance pressure, both move to top priority.
If anyone has privileged access: Teleport. Engineers SSH-ing into production is the canonical case; IT admins logging into servers is the other. If you are SaaS-only, skip it.
If your team logs in to apps without single sign-on: Keycloak. If you already have SSO via Okta, Entra ID, or Google Workspace, do not migrate unless renewal pricing forces the conversation.
Always, regardless of inputs: Velociraptor on the endpoints that matter. If you have already had an incident in the last twenty-four months, move it to the top of the list — that one event paid for the deployment.

That is the entire stack. Three or four services for a SaaS-only firm with SSO in place; five or six for a software shop with cloud infrastructure and compliance pressure. Never eight unless you genuinely have eight asset classes to defend.

These three line items show up in nearly every proposal SMBs forward to us. None of them belong in an SMB program at this scale.

Enterprise SIEM licences for sub-$25M businesses. A Splunk or QRadar contract is a $100K+/year commitment, and most of the value goes unused because the buyer has neither the volume nor the headcount to triage what the SIEM flags. Wazuh covers the same need and the operational burden lands on us, not you.

24/7 in-house security operations centre. Three rotating analysts is $400K+/year of fully-loaded salary before tooling. For an SMB with one significant event every two or three years, that is the wrong cost shape. A managed detection-and-response provider with a contractual response service-level solves the same problem at a tenth of the cost.

Premium awareness platforms. “Adaptive, AI-personalised” awareness suites at $14 per user per month land near $7K per year for a 40-person firm — closer to $20K once “executive simulations” and “industry-specific content” tiers are added. A $4-per-user-per-month tool runs the same monthly phish-and-train cycle. The Hiscox SMB Cyber Readiness 2025 data shows no measurable click-through difference between the premium and mainstream tiers; the price gap is marketing.

How to pressure-test any quote you get

Five questions for the next vendor proposal that lands in your inbox.

“Which of these line items maps to a specific asset I have?” Right answer: every line. If an item does not map to an asset you actually own, it does not belong in the proposal.
“Which two would you remove first if my budget were 30% smaller?” Right answer: a clear, ordered list. A vendor who cannot sequence is selling the bundle, not the program.
“Where do you earn commission, rebate, or referral on the products in this proposal?” Right answer: a specific dollar figure or a confident “we don’t.” Anything vague is bias.
“If I prefer the open-source alternative for any of these, can you operate it?” Right answer: yes, and they should name which projects they have running. A reseller who cannot operate the open-source equivalent is selling the licence, not the outcome.
“What is the first thing we drop in year two if it isn’t earning its place?” Right answer: a named tool with a named criterion. “Everything is essential” is the wrong answer and a warning about everything else in the proposal.

Run the recommender

The stack recommender on this site does the asset-mapping in eight questions, including the part where it tells you explicitly which services to skip. The output names the open-source projects, links to how we operate each of them, and never asks for your email to see the result.

Run the recommender →