The Renewal You Should Decline: Five Security Buys Small Teams Quietly Regret

There is a pattern to how small organisations buy security. Something alarming happens — a supplier gets hit, a client sends a stern questionnaire, an insurer asks a question nobody can answer — and within a fortnight someone is on a demo call being shown a dashboard with a map on it.

Maps are lovely. Maps do not stop a invoice-fraud email from landing in your finance inbox.

This is not an argument against spending money. It is an argument for spending it on the boring things that work. Below are five purchases we see UK small teams make over and over, why they tend to disappoint, and what to do instead. Prices are indicative, ex-VAT, and worth re-checking — vendors move goalposts more often than they move features.

1. The diet SIEM nobody logs into

A cut-down security information and event management platform — usually a cloud log tool with a security tab bolted on — gets sold as 'the single pane of glass'. For a 30-person organisation, that pane of glass mostly shows you a lot of nothing, plus 400 alerts a week you do not have the hours to triage.

The failure mode: ingestion-based pricing quietly climbs as you add Microsoft 365, a firewall and a couple of SaaS apps. Six months in, one person is half-heartedly checking it on Fridays. Alert fatigue turns real signals into background noise.

Do this instead: turn on the logging and alerting you already own. Microsoft 365 Business Premium and Google Workspace both ship with decent alerting that nobody has configured. If you want something more centralised for free, look at NCSC's Logging Made Easy build, or Wazuh if you have someone comfortable on Linux. Then put a 20-minute weekly review in a calendar with a named owner, and a note of what was checked.

Procurement note: if a vendor cannot tell you what a typical month's alert volume looks like for an organisation your size, walk away. Ask for a 30-day pilot with your real data, in writing.

2. The 'AI-powered' email gateway that duplicates what you already pay for

These bolt-on filters usually promise to catch the clever stuff — impersonation, business email compromise, a supplier's 'updated bank details'. What they often do is add a second layer of generic spam filtering on top of the one in your mail platform, with a management console someone has to learn.

The failure mode: false positives on genuine invoices, users start asking IT to release quarantined mail, and the actual BEC attempt arrives from a compromised legitimate account anyway — so no content filter sees anything wrong with it.

Do this instead: finish the free work. Publish and enforce DMARC, check your posture with NCSC's Email Security Check, turn on the native anti-phishing and impersonation policies in your mail platform, and add a one-line callback rule for payment changes: any new bank details get verified by phone on a number you already had. That rule costs nothing and catches more fraud than any filter.

Procurement note: ask the vendor to show you, live, how it handles an email from a genuinely compromised supplier account. If the answer is 'machine learning', ask again.

3. Dark web monitoring with nobody to action it

A monthly PDF listing email addresses found in a breach sounds dramatic in a board pack. In practice, most of those credentials are years old, and the report lands with someone who has no process for what happens next.

The failure mode: it becomes a compliance artefact. Nothing is reset, nothing is investigated, and the subscription quietly renews.

Do this instead: claim your domain on Have I Been Pwned's free domain search (verify it via DNS or email) and set up breach notifications. Pair that with universal MFA — especially on email, your registrar, and anything that can move money — and a rule that any credential appearing in a new dump gets a forced reset within 48 hours.

Procurement note: if you do buy monitoring, insist the contract includes a workflow, not just a feed. Who gets the alert? What is the SLA? What does the vendor actually do at 2am?

4. The awareness platform full of stock videos

Annual licence, forty modules, a cartoon about tailgating, and a completion rate hovering near 60% because people click through on their phones during lunch.

The failure mode: you get a percentage for the insurer and very little change in behaviour. Nobody remembers module nine.

Do this instead: run NCSC's free Exercise in a Box sessions — they are short, practical, and built for exactly this size of organisation. Add a quarterly 15-minute team briefing built from a real phishing email someone actually received, and run a low-stakes phishing simulation once a year. Budget: a couple of hours of someone's time.

Procurement note: if you keep a platform, buy the shortest useful licence and measure click-through on your own simulations, not module completion.

5. The compliance dashboard sold as security

GRC platforms are designed for organisations with a compliance team. Small teams end up paying four figures a year to maintain a digital version of a spreadsheet they were perfectly capable of maintaining themselves — often to chase a framework they could evidence more cheaply.

The failure mode: the tool becomes the project. Weeks go into populating controls, and the actual gaps sit there untouched.

Do this instead: if a client or insurer wants proof, Cyber Essentials is a reasonable, well-recognised UK baseline and certification through IASME runs to roughly £300–£400 plus VAT for most small firms. Track your controls in a shared spreadsheet with a named owner and a review date. It is unglamorous and it works.

Procurement note: check auto-renewal clauses — a 30-day notice window buried in a three-year term is a common trap — and ask whether the platform supports the framework your customer actually named, not the one the sales deck leads with.

The test to apply before you sign

For any security purchase, ask three questions in this order: what specific risk does this reduce, who in this building will act on what it tells us, and what would we do if we did not buy it? If the third answer is 'something free that we haven't switched on yet', start there. You can always buy the dashboard later — it will still be for sale.