Four jobs cloud security software has to do before you pay for more

Almost every small business considering a purchase in this category already owns most of what it needs and has not switched it on. That is not a criticism, it is a description of how platform licensing works: the controls arrive off, buried under headings nobody reads, and a product that lights them up in one screen looks like new capability.

So the evaluation starts inside your own subscription. What survives that is a genuine gap, and a genuine gap is worth buying for. Nothing below names a product or quotes a price.

What to take away

The four jobs

Tell you what you are using. Every subscription the business has, including the ones a single person signed up for with a company card. You cannot secure a service nobody knows exists, and finding them is a job in itself.

Watch the configuration rather than the traffic. Sharing defaults, external access, permission models, retention settings, whether the second factor is enforced or merely available. Almost every cloud data loss in a small business is a configuration that was always going to do that, not an intrusion.

Show standing access. Connected applications, integrations and consent grants hold access that persists after the person who approved it has gone. This is the least visible risk in the category and the one a tool genuinely helps with, which is why cloud security treats it as invisible access rather than as a feature.

Keep evidence you can read later. Who signed in, from where, what was shared, what changed. The question is how far back, and the answer in an included tier is often shorter than the time it takes to notice a problem.

Start with what you own

Before any trial, spend an afternoon on your existing platform.

Most businesses find three or four real problems in that afternoon, and none needed a purchase.

What remains after it is the shape of the gap. The National Institute of Standards and Technology's guidelines on security and privacy in public cloud computing is a fair, vendor-neutral description of which parts of the arrangement remain yours regardless of what you buy.

The trial

Two weeks on your real subscription, with these tests.

Discovery. Does it find a subscription you did not tell it about? A tool that reports back exactly what you configured has discovered nothing.

A deliberately bad configuration. Share something too widely in a test area, or grant a test application broad access, and see how long the tool takes to say so and by what route.

Retention. Ask it a question about something that happened before the trial began. This is where included tiers and paid tools genuinely differ, and deciding how much history is worth keeping is the subject of the same institute's guide to computer security log management.

Noise. Count the findings in week one and week two. A tool producing more than a person will read has produced nothing, which is the same failure that applies to any monitored control.

Removal. Use it to remove a standing access grant, then confirm from the platform itself that the grant is actually gone.

Exit. Disconnect the trial and check what access it retains. A security tool is itself a standing integration with broad permissions, and that is worth watching closely.

Reading the sales material

The last row deserves attention. The tool becomes one of the most privileged connections into your environment, and it should be protected accordingly, under the rules in identity and access.

Where the gap usually is

For most small businesses the honest gap is retention and evidence, not detection. Included audit logs are short, and the moment you need them is always further back than they reach.

The second gap is inventory, in a business that has grown by adding subscriptions. The third is the standing access nobody reviews.

None of those three is a detection product, which is what the category mostly sells. Buy against the gap you measured rather than the one being described to you, which is the same purchasing argument security foundations makes throughout.

What the tooling never covers

It does not hold an independent copy of your data. Provider retention is not a backup, and the distinction is set out in backup and recovery.

It does not decide what happens when something is found, which is a decision that belongs on the page described in incident response rather than in a console.

Common questions

Is the security included in our platform good enough?

For many small businesses, once it is actually configured, yes for the first two jobs and thin on the fourth. Measure the retention figure first, since that is the specific place the included tier is usually shorter than you need.

How do we find subscriptions nobody remembers?

Card and bank statements are the most reliable source, followed by the connected applications list on your main platform, followed by asking people directly and promising nobody is in trouble.

Should we buy something that changes settings on its own?

Only where you can state exactly what it may change and reverse it. Automatic remediation on a platform the business runs on is a powerful thing to hand over on trust.

What if we use several platforms?

Then the inventory job and the evidence job get harder, which is precisely where a tool starts to earn its license. Run the afternoon exercise on each platform first, because the gap is rarely the same size on both.