A small or medium business runs the same cloud applications and the same remote workforce as an enterprise, and it faces the same ransomware crews, but it has no dedicated security staff. What it has instead is 5 to 10 disconnected point products (a firewall from one vendor, Wi-Fi from another, endpoint protection from a third). Each one has its own renewal, its own console, and its own learning curve, and nobody is watching any of them after 5 p.m.

The mid-market company grew by acquisition and improvisation. It has MPLS circuits it can no longer justify, a different firewall brand for each era, cloud workloads in two providers, and a 3-person security team sorting through thousands of alerts across 25 to 45 consoles that don’t talk to each other. They can’t hire their way out, because the talent isn’t available at their pay band, so every new tool makes the day-to-day problem worse.

Every acquisition, cloud migration, and hot new category added vendors, and none removed any. The result is 45+ security tools with overlapping licenses worth millions, a security operations center that spends more time connecting tools than investigating threats, and a mean time to respond measured in days. Meanwhile the board, under Securities and Exchange Commission disclosure rules and cyber insurance scrutiny, is asking the chief information security officer a question that pile of tools can’t answer: what is our actual security posture, in one view?

A major enterprise doesn’t just have too many vendors. It adds more every year. Each acquisition arrives with its own firewalls, its own endpoint agent, and its own security operations habits, and integrating that inherited set of tools takes 12 to 18 months per deal while the business closes the next one. Meanwhile the security operations center drowns at scale, auditors multiply, and the chief financial officer looks at 60+ security line items renewing on 60 different dates, with no leverage in any single negotiation.

The global enterprise operates in 100+ countries as one attack surface, but decades of regional autonomy left 3 to 5 parallel sets of security tools, each negotiated locally, staffed locally, and configured differently. Data residency law (GDPR, China’s Cybersecurity Law, India’s Digital Personal Data Protection Act) rules out the lazy fix of centralizing everything. Handoffs between regional security operations centers lose context as the work follows the sun. And an incident anywhere, whether at a plant in Asia or a branch in Latin America, is a disclosure event for the global parent company.

The convergence of information technology and operational technology connected 20-year-old programmable logic controllers, Windows XP-era human machine interfaces, and flat plant networks to the corporate network and, through it, to the internet. These systems cannot be patched without halting production, and a single ransomware foothold in the office network can now spread sideways into the production line. Unlike an office breach, the downside here is measured in stopped production, safety events, and regulatory findings under NERC CIP, IEC 62443, and Transportation Security Administration directives.

Carriers watch connectivity margins shrink every year while their enterprise customers ask them for managed security. But building a security service on general-purpose infrastructure means per-tenant costs that grow in a straight line, with more processors, more racks, more power, and more licenses. It also means a patchwork of management tools from each vendor, which turns every new service offer into a six-month integration project.

Municipalities, school districts, and agencies run decade-old infrastructure with skeleton IT teams, hold troves of citizen and student data, and cannot simply go dark to recover. That is exactly why ransomware crews prioritize them. Every dollar is a taxpayer dollar spent in public. Procurement is slow, headlines are fast, and compliance obligations (FIPS, CJIS, StateRAMP, and FERPA) come with no matching budget line.