Payroll System Data Protection at the Core of Inzenius
Inzenius’ ISO 2007 Cyber Security Journey has been an interesting process, with myriad requirements and process documents for accreditation, requiring a deep audit of the company’s practices and security strategies.
Data protection with Inzenius
The Inzenius security design began with a ground-up software platform design and capabilities, followed by the business processes required for its ISO2007 quality management and ATO STP Security accreditations. The principles of these accreditations were straightforward, as Inzenius has always been innovative in its business activities, securing a patent for its software from inception as a driver of quality and capability.
Throughout Inzenius’ quality journeys, the company has applied the basic principle of laying the foundation for success from the very beginning.
The data protection landscape has changed
Today, the cybersecurity environment has a new, more dangerous threat: “The practical reality for business leaders is unmistakable: artificial intelligence has given malicious actors new capabilities and introduced new threats.” Daniel Dobrygowski HBR Contributor.
Cyber Attack impact for the business goes beyond the disruption and energy required to restore its processes, including system and data restoration, lost revenue, legal and compliance issues, its position in the market, employee loss of confidence and possible turnover and other costs
Data Protection has changed with AI
Inzenius has just completed, with assistance from the R&D incentive program, a 3-year journey of research and development into innovative cyber security principles that not only meet the requirements of our ISO 27001 accreditation activities but also extend them. That’s the Inzenius way.
We will not, of course, release what we have undertaken in our cybersecurity journal, but suffice it to say it is innovative and delivers not only enhanced cybersecurity protection but also a disaster recovery process for the most important undertaking: paying people correctly and on time.
Inzenius has never been, nor will we ever want to be, in a position where we can’t process our customers’ payroll obligations, even if the internet is down for any reason, as was the case with the Microsoft internet outage caused by the Microsoft update release in 2024.
Payroll disruption is not an option
The responsibility of accurately and compliantly paying people’s wages is a responsibility those of us in the payroll field understand that whilst business processes and resource interruptions can be faced, payroll processing cannot be one of them, ever.
The Sydney Water Dayforce Payroll Interruption Case: while not caused by a cyber-attack, the impact on workers who need their pay to cover living expenses is the same. https://www.hrleader.com.au/law/28581-union-takes-legal-action-against-sydney-water nbsp;
https://www.hrleader.com.au/law/28581-union-takes-legal-action-against-sydney-water
This HBR article outlines actions the business can take to reduce the risk of a successful cyber-attack.
How AI Is Changing Cyber Threats—and Cybersecurity—for SMBs
by Daniel Dobrygowski HBR Contributor
Summary.
Small and medium-sized businesses (SMBs) have long been at a disadvantage on cybersecurity. State-of-the-art cybersecurity and resilience programs have historically been expensive and pursued only by the largest companies with the largest budgets. Now, artificial intelligence is giving malicious actors new tools and capabilities, and introducing new threats. As such, risk for SMBs is also growing. But AI cuts both ways: It can also be a tool that can help SMBs become better protected and more resilient. The good news is that this doesn’t require spending money on brand new software, services, or tools. Solid, free resources can help companies get this right. Services or partners SMBs likely already use also offer new capabilities that just need to be activated in this new environment. Once SMBs are “brilliant at the basics,” there are five further steps they can take.
The cybersecurity outlook for small and medium-sized businesses can seem dire. Cybercriminal and nation-state cyberattacks appear to be on the rise, especially against utilities and small businesses. At the same time, there are new AI-enabled cyber risks, including AI agents from frontier labs breaching confinement and attacking other companies. Generative AI and machine-learning models have also streamlined traditional attack vectors. Phishing lures are now hyper-personalized, vulnerability discovery is exponentially faster, and ransomware operations are automated and ubiquitous.
The practical reality for business leaders is unmistakable: artificial intelligence has given malicious actors new capabilities and introduced new threats.
Small and medium-sized businesses (SMBs) have long been at a disadvantage on cybersecurity. State-of-the-art cybersecurity and resilience programs have historically been expensive and pursued only by the largest companies with the largest budgets. SMBs, on the other hand, tend to fall below the “cybersecurity poverty line,” lacking the financial, technical, or human resources required to maintain effective defenses. According to a 2026 Verizon cybersecurity report, in cases where the the company size was known breaches appeared to disproportionately impact businesses with fewer than 1,000 employees.
These attacks can be devastating for smaller companies. According to a 2026 report from Sophos, the cybersecurity firm I work for, the median cost of recovering from a ransomware attack—which includes system and data restoration, lost revenue, legal, compliance, and other costs—was $375,000. These costs span a wide range, however, depending on the size of a business’ digital infrastructure. The report found that the mean recovery cost was $1.7 million.
Moreover, vulnerability to cyberattacks can hurt SMBs’ position in the market. Both cybersecurity and resilience are core components of digital trust and organizational reliability. Customers, investors, suppliers, and insurance carriers increasingly evaluate a company’s market viability through its security posture. A single breach can instantly erode customer confidence that took decades to build.
SMB leaders need to understand the rapid evolution of AI-enabled risks so they can prepare for them. Based on my two decades of work on cybersecurity and technology governance, including leading the cyber and AI legal function at one of the world’s largest SMB cybersecurity partners, I explain what leaders need to know about how threats are changing, the basics of how they can protect themselves, and five additional actions they can take to make their companies more resilient to the future of technological risk.
How AI Is Changing Cyber Risk for SMBs
Right now, SMB leaders face a compounding risk environment driven by three converging pressures:
- Ever-faster adversaries: Attackers leverage AI to scan networks continuously, automate exploit execution, and execute credential harvesting at unprecedented scale.
- Shadow AI and digital detritus: To boost efficiency, employees frequently adopt unvetted AI tools. Inputting proprietary code, customer records, or financial data into public LLMs can create severe data leaks. This risk further compounds existing “digital detritus” most companies deal with: accumulated legacy software, unpatched firewalls, forgotten cloud databases, and unmanaged IoT devices that can expand an SMB’s attack surface beyond its already limited capacity to track.
- Expanding regulatory obligations: Governments recognize these systemic risks and are expanding compliance standards. Frameworks like the European Union’s NIS2 Directive and Cyber Resilience Act are moving beyond critical infrastructure to encompass any company with a digital footprint. Noncompliance now carries significant legal exposure and financial penalties. In the U.S., recent executive orders included the establishment of an AI cybersecurity clearinghouse and actions aimed at strengthening national cybersecurity, despite the White House otherwise taking a hands-off approach towards AI.
SMBs are at a particular disadvantage in this moment because, historically, it wasn’t practicable for most of these companies to build defenses like those deployed at Fortune 500s. They counted on being too small to be attractive targets for hackers. But cybersecurity for SMBs has also lagged in part because of decisions by business and government leaders to cut back on defensive cybersecurity. Many companies view cybersecurity as an expensive operational cost rather than an important investment in longevity and resilience, or mistake the extent of the threat landscape. That view, coupled with a mistaken view of cyber threats as a static, minimal risk, has led to a short-sighted deprioritization of cybersecurity programs just as the cyber threat was growing.
While AI has ramped up that threat even more, new technologies also bring the opportunity and resources to make different decisions.
The same advances empowering cybercriminals are driving a parallel “democratization of cybersecurity,” making enterprise-grade capabilities accessible to smaller organizations. That does not mean that every SMB leader now has to add “AI-cybersecurity expert” to their long list of responsibilities. It does, however, require them to be equipped offer strategic leadership, clear risk governance, and an understanding of accessible tools and external partnerships.
The good news is that doing this doesn’t require spending money on brand new software or services. There are solid, free resources available to help companies get this right. There are also new capabilities available from services or partners SMBs likely already use that just need to be activated in this new environment.
Before thinking about AI solutions or trying to adopt advanced AI capabilities, organizations must ensure they are “brilliant at the basics,” which is the focus of a recent Pentagon initiative. Rigorous cyber hygiene remains the most effective barrier against both standard and automated attacks. Leader should also look at the FBI’s framework “Operation Winter SHIELD: Ten Actions to Improve Cyber Resilience,” which covers steps every company should execute, including enforcing multifactor authentication (MFA), maintaining isolated backups, and automating patching schedules.
A Cyber-AI Ladder for SMBs
Once the fundamentals are covered, companies should consider five actions that can help them further elevate their security posture, whether to meet regulatory demands, satisfy supply-chain requirements, or protect digital trust. These actions—listed in order of ascending technical complexity—can help SMB leaders harness AI by themselves or in partnership with others.
1) Use AI security features in tools you’re already paying for.
Most SMBs already use a wide array of digital technologies in their businesses, including simple tools like email and web hosting. These services increasingly include AI cybersecurity tools that simply need to be turned on. Whether it’s Google Workspace or Microsoft 365, check settings on current tools to take advantage of new security features built into services the business already pays for.
For example, SMBs increasingly use password managers in order to support light-effort access controls across their business. Those tools increasingly offer AI-powered options to check for password compromise or offer other security benefits.
2) Eliminate digital detritus.
The foundation of cyber resilience requires minimal technical sophistication. Leaders should conduct a digital security audit to eliminate “digital detritus,” which includes legacy and outdated software and hardware, as well as unmonitored connected assets and collected data. These unnecessary data and unpatched, unsupported, and vulnerable pieces of legacy IT infrastructure can and should be identified and decommissioned.
Knowing what is on your system is the first step to securing it. AI tools can help transform the audit from a slow, manual checklist into a fast, continuous, and highly accurate process. Start with superfluous data. If the business uses Microsoft 365 or Google Workspace, it will likely have access to built-in governance tools that can help start the hunt for digital detritus. Microsoft’s Purview and Google’s Vault offer basic retention, data minimization, and inactivity classification policies embedded into services many SMBs already pay for.
Open-source network mapping tools are also increasingly available for more technically advanced users. These can help identify potentially forgotten and exposed devices on a business’s network. For instance, AIMap, which can be found on GitHub, is an open-source tool that queries public endpoints and assigns a risk score based on likelihood of unauthorized access.
Leaders will still need to protect or sequester private data or networked devices and to determine the level of acceptable risk for their company, but this process supports an informed decision about what the risk really is.
3) Test your cyber resilience.
Using AI to prepare for resilience may require some additional knowledge or proficiency with existing AI tools. But taking the time to learn how to use AI to make resilience plans and test your own network has significant cybersecurity benefits. SMB leaders can use AI chatbots (if they are already on a paid tier of Claude, Gemini, ChatGPT, etc., with data sharing turned off) to help them write comprehensive and company-specific security policies. Here, there is no added cost beyond your time, but users should exercise caution in ensuring no confidential or sensitive information is provided to the chatbot without assurance that such information will be protected and won’t be used in training data.
To make best use of the chatbot and avoid pitfalls like hallucinations or authoritative-sounding falsehoods, you should use AI to augment, rather than replace your judgment. You can have AI generate a template for your company’s cyber resilience plan, including areas that may require further investigation, fill in the details based on your knowledge you’ve gained, and then come back to the chatbot to find inconsistencies or missed risks.
SMBs with technical experience or support can employ LLMs and AI security agents to perform defensive simulation (or “red-teaming”). The recent travails of frontier models hacking companies during safety testing shouldn’t be an issue for companies using commercial models, since adequate measures are usually already in place to prevent released models from “going rogue.” So, with appropriate safeguards in place, testing network resilience with controlled AI agents in this way helps uncover unpatched vulnerabilities before malicious actors exploit them.
Experimenting with defensive simulation requires isolating the environment the AI agent acts in, implementing strict access controls outside the sandbox, continuous monitoring and oversight to ensure the simulation doesn’t become an actual incited. With adequate preparation, AI-enabled phishing simulation tools have also become a very affordable way to test for the most common source of SMB breaches.
4) Explore “hiring” a virtual CISO.
Few SMBs can afford to hire a full-time Chief Information Security Officer (CISO) to lead cyber risk management and operational continuity. Even if money was not a factor, there are not enough qualified cybersecurity leaders to go around, with a reported 10,000:1 business-to-CISO ratio.
Now, AI-augmented virtual CISOs are available as a service, usually combining integrated technology, agentic AI, and active threat intelligence with human expertise. These services typically offer a dashboard-driven tool for leaders to evaluate how well an SMB’s security controls are working, monitor the firm’s security posture on an ongoing basis, and assess performance. These services can often be arranged through the company’s existing managed service provider (MSP) at less than one-tenth of the cost of a full-time cybersecurity leader.
5) Partner with an AI-native managed detection & response (MDR) firm.
The best leaders—in SMBs or elsewhere—know when to call for help. Where dealing with AI-augmented cyber threats, software tools alone can be insufficient if a high volume of alerts sit unaddressed during off-hours. If this is likely, then the most effective move for comprehensive protection is partnering with managed detection and response (MDR) providers, which combine centralized AI threat analytics with human threat-hunting teams to investigate and neutralize active attacks. (Disclosure: I work for a company that does this.)
Where smaller companies are increasingly facing the same cyber threats as the largest enterprises, partnering with an MDR provider allows SMBs to take advantage of enterprise-grade security operations, without a full-time enterprise-level security team.
. . .
Cyber resilience in the AI era is not determined by how much capital a company spends, but by how effectively its leaders evaluate risk, clean up their digital shop, and leverage smart technology partnerships. While AI advances raise the stakes for small and medium-sized businesses, they also grant small teams vastly improved defensive capabilities. By systematically automating basic hygiene, eliminating digital detritus, using advanced security tools, and engaging strategic cybersecurity partners, SMB leaders can rise above the cybersecurity poverty line, turning a strong cyber defense into a clear business advantage.
Frequently Asked Questions
Should we apply for SOC 2 or ISO 27001 accreditation?
The simple answer is: if your insurance or your clients are requiring you to, then I believe you should
Is it expensive to gain SOC 2 or ISO27001 accreditation?
It can be, if you don’t have the required systems in place.
Remember, the costs may be higher in the monitoring of compliance and response costs if attached
What is the most important element of a good system?
- Maintaining software updates as required
- Staff training in security protocols for the business
- Good MFA and password processes
- Having good staff engagement in adherence to the compliance procedures and activities
- Well-documented procedures that compliance will be measured against
- Easy-to-use monitoring of your IT environment