Small and medium size businesses do not typically have IT Security departments to manage their cyber-security. In fact, even firms with IT staff often exhibit a glaring lack of security expertise. This can lead to a fatalistic attitude towards cyber-security and a kind of paralysis in which even modest initiatives that would dramatically improve the organization’s defensive posture are not undertaken.