The Stubborn Client: Why Small Businesses Ignore Post-Breach Fixes

Hackers & Hooks | Season 1, Episode 10

A small business gets breached. A response team investigates, cleans up the damage, and hands over a list of recommendations so it does not happen again. Months later, that list is still sitting on the to-do pile, and the business is still exposed to the same problems that let the attacker in.

That is the situation Nick Gipson described on this episode of Hackers & Hooks. He was joined by Rich Bates of The Prydwen Advisory, which helps small and midsize businesses work through the Cybersecurity Maturity Model Certification (CMMC) program and advises them on cybersecurity more broadly. Together they talked through why some clients do not act on advice, even after an attack, and what it takes to change that.

The Breach Was Cleaned Up. The Risk Was Not.

One of Nick’s clients had a breach. His team investigated it, cleaned it up, and delivered a list of recommendations. Then nothing happened. Nick could not say whether the client had not made the work a priority or simply did not see it as one. Either way, the business was still vulnerable to the same things.

Rich’s view is that many owners miss how a breach changes their position. Once attackers have been inside, he said, the business has a target on its back. Criminals tend to take the easy path, and a business they have already explored is easier than a new one.

“They know your landscape, they know your weaknesses, and they’ve probably, in that first breach, mapped out other vulnerabilities other than the one they used.”

Rich Bates, Hackers & Hooks

He added that attackers sometimes leave “a little present behind”: a hidden way back in that lets them return with half the effort. That is why the recommendations after an incident are not optional extras. They are the part of recovery that keeps the same thing from happening twice.

Why Busy Owners Stall After an Attack

Rich pointed out that small and midsize business owners spend most of their time running the business, which he sees as the right priority. What gets missed is the ripple effect of a breach. It is not only the money lost or a few days of downtime. In a connected world, a breach rarely stays secret, and customers start to wonder, as Rich put it, why they should trust you with their business if you are not paying attention to your own.

Rich said the two biggest obstacles are budget and scope. Hand an owner a full security framework and say “just follow this,” and you get a deer in the headlights. He once asked a well-established company where its risk register was (a running list of business risks, ranked by how much they matter), and the answer was a blank look. Without one, there is no clear way to decide what to fix first.

Some owners lean on habit. Nick’s view is that the world has changed, and businesses that carry old assumptions into it are often among the first to be compromised. Rich pointed to two well-known examples of how the idea that a business is not really connected breaks down. In 2013, attackers got into Target’s network using credentials stolen from a heating and air conditioning contractor. In another widely reported case, attackers got a foothold in a casino’s network through an internet-connected thermometer in a fish tank. A small shop that receives plans or invoices by email is connected too, and every connection is a possible way in.

Finally, there is the part-time IT problem. Rich recalled a business whose entire IT department was one part-time, semi-retired employee who knew something about computers.

“You’re gonna pay for him twice. You’re gonna pay him to do the job, not do it right, and then you’re gonna pay when you get breached.”

Rich Bates, Hackers & Hooks

His advice was not to let that person go. Keep them for day-to-day needs, and bring in people who do security every day. Nick added an important point: handing work to an outside provider does not hand off responsibility. A business that uses a payroll company still owns its payroll, and an owner who uses outside help still owns the security of the business.

Lessons for Small Businesses

• Treat the fix list as part of the recovery. Give every recommendation an owner and a target date, and review progress until each one is done. If you decide not to fix something yet, write down that you are accepting that risk and when you will revisit it.
• Start a simple risk register. A spreadsheet that lists what could go wrong, how much it would hurt, and what you plan to do about it is enough to start setting priorities instead of guessing.
• Shrink the framework to fit your business. You do not need to adopt a full framework on day one. NIST publishes a Small Business Quick-Start Guide for its Cybersecurity Framework, and an advisor can tailor it to your size and risk.
• Use what you already pay for. Rich described a client paying for Microsoft 365 plus separate tools that overlapped with it. Check what your subscriptions already include before buying more. Layered security means different protections at different points, not the same kind of tool installed three times. As Nick and Rich noted, overlapping endpoint tools can fight each other and even lock up computers.
• Turn on multi-factor authentication everywhere you can. MFA (a second check beyond the password) is widely available and often included in services you already use. It is not a cure-all. Nick has seen attackers take over a browser session that had already passed the MFA check, which is why monitoring still matters.
• Make it safe to report mistakes. If someone clicks a phishing link, shaming them teaches everyone to hide the next one. Stay calm, fix it, and use it as a lesson. In Rich’s words, security culture “can’t be sprinkled on, it has to be baked in.”

How Gipson Cyber Helps

Gipson Cyber is built around response, not alert volume. When something goes wrong, Business DFIR (digital forensics and incident response) puts real human responders on the problem to help investigate and contain it. Good small business incident response does not end when systems come back online, so our reports are written in plain English, with recommendations your leadership, IT team, or MSP can act on.

For ongoing protection, Business SOCaaS provides 24×7 monitoring by real human responders. It works with the security tools you already have and alongside your existing IT team or MSP, not in place of them. It is a managed SOC for small business, built to fit beside the people you already trust.

If you are dealing with an active attack right now, go to 800cyber.com. If you have a fix list from a past incident that never got finished, reach out and we can talk through where to start.