Why Frameworks Fail: A Founder’s Guide to Resilient Security

I used to treat cybersecurity like a compliance checkbox. We’d buy a framework, hire a consultant to stamp a report, and assume the problem was solved. It looked like security from the outside, but it offered zero protection when a ransomware group actually knocked on the door. We called it “framework theater,” and it was a dangerous illusion.

The reality is brutal. According to data cited by Passwork, 60% of small businesses that suffer a cyberattack shut down within six months. The cost of inaction isn’t just financial; it is existential. Cybersecurity isn’t an IT task. It is a business continuity problem. As Noel Bradford and Mauven MacLeod argue in The Small Business Cyber Security Guy podcast, leadership failures and a lack of supplier access reviews are often what make incidents costly enough to kill a company.

We stopped buying expensive frameworks. We stopped chasing the latest security trend. Instead, we focused on the four controls that actually stop ransomware and keep the business running.

Control 1: MFA That Actually Works (Beyond the Basic Prompt)

Multi-Factor Authentication (MFA) is the single most effective control for preventing account takeovers, but only if implemented correctly. The biggest mistake teams make is treating MFA as a “turn it on and walk away” feature. It is not. It is a foundation, not a finish line.

Basic SMS-based MFA is vulnerable to SIM-swapping and phishing attacks. For high-value accounts, such as finance and executive roles, you need phishing-resistant MFA. For the rest of the team, security defaults are a good start, but conditional access is where the real protection lies. Conditional access allows you to restrict logins based on location, device health, and risk level. If a user logs in from an unusual location or on an unmanaged device, the system should block or challenge them, not just send a text message.

The “turn it on and walk away” trap creates user friction. When MFA is poorly configured, support tickets explode. We learned to plan for this friction. We provided backup access methods and clear documentation. To reduce vendor lock-in and cost, we considered open-source options like Aegis Authenticator for mobile devices. This keeps the control in our hands and reduces dependency on proprietary ecosystems.

Control 2: Patching and EDR: The End of the Perimeter

The old model of security relied on a perimeter box—a firewall that kept the bad guys out. That model is dead. Modern attacks come from inside the perimeter, often through exploited vulnerabilities in software that should have been patched months ago.

Traditional antivirus relies on known signatures. It fails against modern fileless attacks and zero-day exploits because it doesn’t know what the malware looks like yet. We needed Endpoint Detection and Response (EDR) for behavior-based detection. EDR monitors for suspicious activity, such as a process trying to encrypt files or access sensitive data in an unusual way. This is non-negotiable for any organization that cannot afford to go offline.

Patching is equally critical, but it requires arithmetic, not just enthusiasm. Not all vulnerabilities are created equal. We prioritize patching based on exploitability, not just CVSS scores. A vulnerability with a lower score that is actively being exploited in the wild is more dangerous than a high-score vulnerability with no known exploits. We conduct baseline vulnerability assessments regularly to know what we have before we can protect it. If you don’t know what software is running on your network, you can’t patch it.

Control 3: Backups That Survive the Ransomware Attempt

Backups are your last line of defense. But a backup is only meaningful if it has been tested. A green report on one day is not the same as discipline over months. If you haven’t restored from your backup recently, you don’t have a backup; you have a hope.

We adopted the 3-2-1 rule: Keep three copies of your data, on two different media types, with one copy offsite. But we didn’t stop there. We use encrypted snapshots to ensure backups are immutable and secure. Tools like Kopia provide encrypted, deduplicated backups that are difficult for attackers to tamper with. If your backups are stored on the same network as your primary systems, they are vulnerable to ransomware encryption.

We defined restoration priorities. Which systems must be restored first to resume trading? Knowing this in advance saves hours of panic during an incident. We test these restorations monthly. An untested backup is just a hope. Discipline over time is what saves businesses.

Control 4: Access Reviews and Identity Hygiene

Shared accounts are a security nightmare. They eliminate accountability and destroy audit trails. If multiple people use the same login, you cannot determine who did what. Every user should have unique credentials. This is basic hygiene, yet it is often ignored in small teams.

We conduct quarterly access reviews. Who has access to what? We remove departed employees immediately. Lingering access is a common vector for insider threats and compromised accounts. Supplier access is another often-overlooked vector. We review third-party vendor permissions regularly. Do they still need admin rights to our systems? If not, we revoke them.

The offboarding process should be automatic, not manual. Manual processes fail. We automate the removal of access across all systems when an employee leaves. This prevents lingering access and reduces the risk of a former employee or their credentials being used against us.

The Practical Roadmap: What to Do This Week

You don’t need a new framework. You need to execute on these four controls. Here is what we did this week:

1. Audit your MFA exceptions: Who is still using passwords alone? Identify them and enforce MFA immediately.
2. Verify one backup: Restore a file from your last backup to prove it works. If you can’t restore, your backup is useless.
3. Check your patch status: Are critical systems up to date? Prioritize patches for vulnerabilities with known exploits.
4. Review vendor access: Who from your suppliers still has admin rights to your systems? Revoke unnecessary access.

These steps are not glamorous. They are not a press release. But they are the difference between a business that survives a cyberattack and one that shuts down. The existential risk is real, but the path to resilience is straightforward.

Sources and further reading

• The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups – Podcast – Apple Podcasts
• Multi-Factor Authentication for Small Business Security
• The 2025 small business cybersecurity checklist: A complete guide | Passwork
• 40 open-source tools redefining how security teams secure the stack – Help Net Security
• The IT Director’s Definitive Cybersecurity Playbook for Small Businesses
• IT Best Practices for Small Business | Cybersecurity Guide