Cheap Security Software Won't Fix the Affordability Crisis

Dark Reading ran a piece last month asking whether cyber is facing an affordability crisis. The answer in the article is yes. Global defence spending is heading for $240 billion this year, the average breach now runs about $5 million, the typical enterprise is juggling 83 tools from 29 vendors, and the small businesses that make up most of the economy can't afford any of it.

All true. And it still lands on the wrong diagnosis.

The problem isn't that security is too expensive. The problem is that the only version of security the industry knows how to sell is the enterprise version, and we keep trying to shrink it to fit a 40-person company. It doesn't shrink. It just gets cheaper and stays useless.

What the article gets right

Credit where it's due. The best quote in the piece comes from Bryson Byrd at Huntress, who points out that venture money builds products for buyers with budgets, not buyers with exposure. That's the whole thing in one sentence. If your company has a security team, the market is drowning in options. If your company has an office manager who also handles IT, the market has almost nothing built for you and a lot of things that pretend to be.

The article is also right that tool sprawl is its own cost. Forty scanners producing overlapping findings isn't coverage. It's noise you pay a subscription for.

And it quietly punctures the idea that AI is going to make this cheap. The organizations quoted expected savings and got token bills instead, and the study it cites found LLM-generated patches failed or made things worse more than half the time. That matches what I'm seeing. AI in the SOC is a cost line right now, not a cost cut.

Where it stops short

Two of the article's three solutions are enterprise answers. “Apply a FinOps model to security spend.” “Measure risk reduction instead of vulnerability counts.” Fine advice for a company with a CISO and a spreadsheet. Meaningless for a dental practice or a trucking company. They aren't governing their security spend. They're buying whatever their IT provider put in front of them, and their IT provider is reselling whatever gives them margin.

That's the piece the article never touches. For most small businesses, the security buyer isn't the business. It's the MSP. If you want to understand affordability at the bottom of the market, you have to look at what the channel buys and what it passes through. The article looks at end-customer budgets and vendor pricing and skips the layer in between where the actual decisions get made.

The repricing argument

Maxime Lamothe-Brassard, the founder of LimaCharlie, picked up the Dark Reading piece and pushed it one step further. His argument: the real change isn't AI in operations, it's AI in development. The cost of building software has collapsed for people who know what they're doing. Products that took years of refinement can now be replicated at a fraction of the cost. So security pricing has to fall from the “secret sauce” level to the “convenience” level, meaning what it's worth to a customer not to build and maintain the thing themselves.

He's right about the direction. A lot of security software was priced on scarcity. The vendor spent years building it, you couldn't, so you paid the moat premium. When anyone competent can rebuild the core of your product in a quarter, the moat is gone and the price has to follow. We've watched this happen in other categories. Security isn't special.

His other point is underrated too: build API and CLI first and you get the AI layer for free, because the frontier labs will do that part better than any vendor can. That's a smarter position than the dozens of companies bolting a chatbot onto a dashboard and calling it a platform.

The domino that isn't

Then he offers the proof: LimaCharlie just shipped a cloud security product, a full CNAPP, at $150 a month flat. First domino.

I don't buy that as evidence. LimaCharlie can do $150 a month because it's a platform business with hyperscaler-style infrastructure already built, and this product doesn't have to carry the company. He says as much. That's not the dev-cost thesis proving itself. That's a bundling play, the same one Microsoft ran when it folded Defender into E5 and reset the price of endpoint protection for everyone. Bundling reprices markets, no argument. But it's a different mechanism than “software got cheap to build.”

The thesis gets proven when a standalone company with no platform to lean on ships a credible CNAPP at that price and survives. That hasn't happened yet. It probably will. But it hasn't.

The cost that doesn't reprice

And here's where both the article and the response miss the same thing. For a small business, the licence was never the expensive part.

The expensive part is the human. Someone has to deploy the tool, tune it, look at what it produces, decide if it matters, and do something about it. A $150-a-month CNAPP at a company where nobody knows what a CNAPP is costs $150 a month and delivers nothing. Cheaper software doesn't change that. It just moves the bill from the vendor column to the labour column, and the labour column was already the one nobody could afford.

The pattern I see after 26 years and more than 600 incident-response engagements is boring. Small businesses that got hit almost never lacked a tool. They had an EDR someone installed and nobody watched. They had MFA on email and not on the VPN. They had backups that had never once been restored. The gap wasn't spend. It was attention, and attention costs the same whether the software is $15,000 a year or $150 a month.

Where cheaper tools do help is MSP and MDR margin. LimaCharlie sells to MSPs and MDRs, so that's exactly who benefits from this. The open question is whether that saving reaches the end customer or gets absorbed as margin. History says the channel keeps it. I'd love to be wrong.

What small businesses actually need

Strip the enterprise model away and what's left is short. MFA on everything that faces the internet, including the VPN and the admin accounts everyone forgets. Patched edge devices, because that's where most of the initial access I investigate now comes from. Backups that get restored on a schedule, not just taken. A person, internal or contracted, who owns those three things and checks them. And a plan for the day it goes wrong: who you call, what you shut off, what you tell customers.

None of that requires a CNAPP. Most of it is free or close to it. The cost is discipline and a phone number.

One caveat, because this isn't a “tools don't matter” argument. Tools matter a lot once there's someone to run them, and the repricing Maxime describes will make it cheaper for MSPs to run them well. That's a real gain. It just isn't the gain the affordability crisis is about.

Bottom line

The vendor market is about to get repriced, and it should. But the affordability crisis for small business was never a software pricing problem. It's an operating problem wearing a pricing problem's clothes. You can drive the cost of a security tool to zero and a business with no one watching it is exactly as exposed as it was yesterday.

Cheap tools fix the vendor's problem. Somebody still has to fix the customer's.