A quote to send, payroll to prepare, a client waiting: in a small business, cybersecurity rarely tops the day’s agenda. Until an email account is hijacked or the invoicing software becomes inaccessible. Should providers play up this threat to sell protection? That is often the surest way to trigger denial. Looking ahead to September 2026, a different sales proposition deserves to gain ground: selling business continuity rather than anxiety. For providers, this means rethinking both their offerings and their messaging.
The real competitor is “we’ll deal with it later”
The need already exists. Publications from ANSSI and Cybermalveillance.gouv.fr have documented ransomware, phishing and account compromises affecting small organizations for several years. But a proven threat does not automatically create a budget. Business owners must weigh up a company vehicle, a new hire and digital spending whose results are, by nature, largely invisible when everything works.
Vocabulary is part of the problem, too. Endpoint detection, monitoring, identity management: a technical catalog can quickly resemble a list of car parts presented to someone who simply wants to start the engine tomorrow. An accessible offering therefore starts with everyday operations: who takes payments, who approves transfers, where are client files stored, and how long can the business operate without its IT systems?
Imagine an agency with twelve employees. Its priority is not necessarily a sophisticated monitoring center. It might be removing former employees’ accounts, enabling multifactor authentication and checking that a backup can be restored. This example is illustrative, but the method applies broadly: translate risk into operational decisions, then prioritize.
The assessment: the first proof of value
A paid assessment can be a good entry-level product, provided it is not a sales pitch in disguise. Its scope must be stated upfront: interviews, an inventory of essential tools, access checks, and a review of backups and payment procedures. An hour-long conversation followed by an automated questionnaire should not be called a “comprehensive audit.”
A useful deliverable is less an intimidating report than a roadmap. It distinguishes between what needs fixing immediately, what can wait and what requires additional expertise. For each action, it identifies an owner, the estimated effort and any dependencies. Clients must be able to use this document with another provider. That freedom makes the assessment more credible.
Public resources already help businesses prepare for this stage. In France, ANSSI’s guides and the awareness programs and guidance services offered by Cybermalveillance.gouv.fr provide useful starting points. Providers are therefore not selling access to otherwise unavailable advice. They are selling its adaptation, implementation and follow-up in a business that is short on time.
The subscription: funding a routine, not a black box
Subscriptions address a practical reality: employees change, software evolves and access permissions accumulate. A one-off intervention is not enough to maintain protection. For an SME, a predictable monthly payment may also be easier to absorb than a major one-off project. But the business still needs to know exactly what it is buying.
A clear core service, justified options
A basic offering can combine update monitoring, workstation protection, access management and backup checks. But no single list suits every business. A shop, a consultancy and an industrial workshop have different equipment and constraints. Standardization should apply to the method, not erase those differences.
- The core service: the protections included, the equipment covered and the checks actually performed.
- Support: service hours, contact channels and contractual response times.
- Incident response: the work included, exclusions and billing arrangements for additional interventions.
Per-user pricing works for some office-based activities. It becomes less relevant with shared workstations, seasonal workers or connected machinery. A package combining a basic support service with a specified number of devices may make more sense. The key is to avoid a low introductory monthly fee that balloons as soon as an ordinary need arises.
The contract must also distinguish between an automated alert and human analysis. Promising round-the-clock monitoring requires an organization capable of delivering it, either directly or through an identified partner. For a new provider, a limited service that delivers on its promises is better than fictitious all-round availability. Trust is lost precisely when the client discovers the difference.
Ongoing support turns spending into capability
Digital protection also depends on shared practices. Verifying a change of bank details through a known channel, reporting a suspicious message, promptly removing access for a departing employee: these routines cost little in equipment but require organization. A short, regular meeting helps more than an annual presentation forgotten the next day.
Training must avoid humiliation. A phishing simulation used to single out “poor performers” risks discouraging reporting. By contrast, an exercise followed by a debrief helps people understand the warning signs and test the reporting chain. The provider is then selling measurable progress: more protected accounts, fewer unnecessary permissions and restores that have actually been tested.
This close support does, however, create an economic challenge. Human support takes time that license fees do not cover. To remain viable, entrepreneurs must define the scope of their meetings, document their interventions and automate repetitive tasks. Specializing in a particular sector can help: understanding its software and critical periods reduces both errors and the cost of service.
Regulation can open the door, but cannot replace the sales case
The GDPR already imposes security requirements appropriate to the processing of personal data. The European NIS2 Directive, adopted in 2022, expanded the European cybersecurity framework; its practical application depends in particular on national legislation and the organization’s circumstances. Not all small businesses are automatically subject to the same requirements. Claiming otherwise to sell a subscription would be misleading.
Requirements can also come from major clients or insurers. For small organizations, this pressure could strengthen demand for support by September 2026: this is a prospect, not an established outcome. A useful provider helps produce proportionate evidence, without promising that a subscription guarantees overall compliance or the absence of incidents.
Building trust all the way through the exit
Finally, exit arrangements deserve a place in the offering. Who holds administrator access? How can configurations and useful historical records be retrieved? What happens to protection when the contract ends? An SME dependent on an opaque provider is not necessarily better protected. Planning a documented exit reduces that dependency and provides a tangible selling point.
What next? For September 2026 and beyond, the most promising model could be a service built on close client relationships: a standalone assessment, a clearly defined subscription and regular support. There is no guarantee it will dominate the market. But it addresses an enduring need: knowing what to protect, how much it costs and whom to call. Cybersecurity then becomes a capability to maintain, rather than a fear to buy.
