Who's Watching Your Security Alerts?
Who's Watching Your Security Alerts?
Most businesses already have tools that send security alerts. Antivirus flags a suspicious file. Microsoft 365 warns about a strange sign-in. The firewall logs something it blocked. The real question isn't whether you get alerts. It's whether anyone actually reads them and does something about it.
The UK's national criminal records office, ACRO, found this out the hard way. Between 2021 and 2023, attackers got into its public website three separate times. Its security software raised warning after warning, including four times it caught and quarantined a tool built to steal passwords. Nobody acted on any of them. In the worst incident, data on nearly 11,000 people was gathered up and staged to be stolen. When the UK's data regulator reviewed what happened, its conclusion was blunt: if the alerts had been acted on, further damage could have been prevented.
ACRO had security tools, and the tools did their job. What was missing was a person whose job it was to look.
Why this happens in small businesses too
- Alerts go to an inbox nobody checks. Often it's whoever set the system up. Sometimes it's someone who left the company years ago.
- There are too many of them. When every alert looks urgent, people stop reading any of them.
- One person knows everything. If the person who understands your IT is out sick or on vacation for a month, who's watching?
- Nobody knows what normal looks like. So nothing looks wrong until something breaks.
What to put in place
- Name an owner. One person or one provider responsible for reviewing security alerts, plus a backup for when they're out.
- Decide what gets escalated, and how fast. A blocked password-stealing tool is not a "look at it Monday" item.
- Write down what was checked. A short note on each alert reviewed. If something does go wrong, that record matters to your cyber insurance carrier.
- Know what's exposed to the internet. Run an outside scan after firewall changes, new remote access, or a new system. Old services nobody switched off are easy targets. ACRO's website software hadn't been updated since 2019.
- Cover nights and weekends. Attacks don't keep business hours. Many start at 2 a.m. on a Sunday for exactly that reason.
For most businesses with 15 to 75 employees, staffing that in-house doesn't make sense. That's what a managed IT partner is for. Our managed cybersecurity includes a 24/7 security operations center for managed clients, so every alert gets a real person's attention, whether it comes in at 2 p.m. on a Tuesday or 2 a.m. on a Sunday.
Do you know where your security alerts go today?
If you're not sure who sees your alerts, or whether anyone does, that's worth 15 minutes to find out. Our free assessment shows you plainly what's being monitored, what isn't, and who's responsible for each. We work with businesses across the Denver metro. No jargon, no pressure.
Not ready for that yet? Get one tip like this in your inbox each week instead.
