Security foundations compared: prevention, detection and recovery

The comparison most small businesses face is not between two products. It is between approaches: do it ourselves, pay someone, use what we already own, buy something dedicated, or spend on stopping things or recovering from them.

Get that choice wrong, and no careful vendor selection rescues it. You will have bought the single best example of the wrong category.

This page compares those approaches. No product names appear, deliberately, because the shape of the decision outlives every name you could put in it.

What to take away

Prevention against detection against recovery

These three compete for the same money and they are not substitutes.

Prevention is cheapest per unit of harm avoided and has a hard ceiling: some things will get through. Detection tells you what happened and is worthless without someone to act on it. Recovery is the only one that works when the other two have already failed, which is the situation you are actually buying for.

A reasonable way to break the tie is to ask what a bad week looks like for you specifically. If the worst realistic outcome is a redirected payment, prevention and process win, and no amount of detection helps because nothing anomalous happened. If the worst outcome is your files becoming unreadable, recovery wins outright.

If the worst outcome is a quiet intruder in your mail for six weeks, you are buying detection and log retention. The useful question there is how far back your logs go.

Most small firms are heavily weighted to prevention and have almost nothing in the third bucket. The check for that imbalance is in security foundations controls.

In-house against managed

The deciding factor is not budget; it is whether the control needs someone awake.

Backups and updates can run on a busy owner's schedule; so can access reviews. A control that produces alerts needing a response within hours cannot, and buying that capability without buying the response is the most common wasted line item in a small security budget.

If you go managed, settle in writing what they are authorized to do without asking. A provider who can only notify you has sold you a faster way to learn bad news.

What you already own against something new

Platform bundles now include a great deal: multi-factor authentication, device encryption, basic anti-malware, conditional rules, mail filtering, audit logs. The instinct that included capability must be inferior to a specialist product is often wrong, and it is expensive to act on.

Compare on three things. Coverage: does the included version apply to every account and device you have, or only to some license types? Retention: how long do its logs last, because that is usually where the included tier is genuinely thinner. Operability: can the person who will actually run it find what they need in the console.

Turn on what you own first, then measure what is missing. Buying to fill an imagined gap while an included control sits unconfigured is not a trade-off, it is two mistakes.

One suite against several specialists

A single vendor covering identity, mail, devices and logs is easier to buy, easier to administer, and gives you one console to learn. It also concentrates your risk: one account compromise, one outage, one contractual dispute, one migration if you leave.

Several specialists give you better individual tools, independence between them, and a pile of integration work that nobody owns. For a team without a dedicated administrator, the suite usually wins on the only axis that matters, which is whether the thing gets configured properly at all.

Two exceptions are worth carving out regardless. Keep your backup outside the environment it protects, because a backup an administrator of the production system can delete does not solve the case you bought it for. And think hard before putting your domain registrar and your bank access behind the same sign-in path as everything else, for the same blast-radius reason.

How to run the comparison honestly

Comparisons go wrong in predictable ways, and all of them come from the two options being asked different questions.

Fix the scenario first. Write down one specific bad day, in a paragraph, and score every option against that same paragraph. Vague comparisons reward whoever wrote the better feature list.

Score the failure, not the demonstration. Ask what happens when this control is bypassed, when the network is down, when the person who set it up has left, and when nobody logs in for a month.

Price the operator, not just the product. Hours per week, by name, at a realistic rate. This single line reverses more comparisons than any other.

Include the exit. What it costs to leave belongs in the comparison of whether to enter, and the answer is usually only discoverable during a trial, as the evaluation method in best security foundations software 2027 sets out.

Before spending anything, read a free structured guide written for organizations your size and use it as the baseline you are comparing against. The United Kingdom's National Cyber Security Centre publishes a guide to cyber security for small organizations, and comparing an option against a free baseline often reveals that the baseline was the answer.

Whoever makes the final call should also be able to explain it in business terms rather than technical ones, which is a skill and not an instinct. The same body's board toolkit is written for exactly that conversation and is useful even when the board is one person.

Common questions

We have no security person. Does that settle the in-house question?

It settles the alerting part of it, not all of it. Controls that are configured once and checked on a schedule are well within reach of a capable owner or office manager. Continuous monitoring is not, and pretending otherwise produces a dashboard that nobody has opened since the week it was installed.

Is it worth comparing at all if we are very small?

Comparing categories, yes, and it takes an hour. Comparing products at length, usually not: below a certain size the sequence in security foundations determines almost everything, and the marginal difference between two adequate tools is smaller than the difference between configuring one properly and not.

How do we compare two options when neither has been tried?

You cannot, meaningfully, and that is the argument for a short trial with a fixed test rather than a longer document review. If a trial is impossible, compare the failure modes and the exit terms, since those are knowable from the contract and are what you will live with.

How often should the approach itself be revisited?

When the business changes shape rather than on a schedule: a new location, a first employee who handles money, a system holding customer data, or an incident. Each moves the worst realistic day, and the worst realistic day is what the whole comparison was anchored on.

Faults that keep recurring are also a signal. The change log kept for security foundations troubleshooting is where that pattern shows up first.