![[Podcast] Where small businesses can start with cybersecurity](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,quality=80,format=auto,width=720,onerror=redirect/uploads/asset/file/21c3768e-1869-46e8-88f2-7082e0967aa2/PODCAST_YOUTUBE_COVER__15_.png?t=1793658537)
A few years ago, our latest podcast guest set out with a mission.
He wanted to help small and mid-sized businesses get a grasp on what they need to be doing for cybersecurity, and to be the resource most of them don’t have.
With a topic as daunting and fear-inducing as cybersecurity, the easiest question to start from might just be: where do you start?
That’s a question our latest guest has helped businesses answer for years, and it’s a big part of why I wanted him on the show.
Episode 5 features my conversation with Patrick Rost, cybersecurity consultant and founder of InfoSecurity Blueprint. We talked about how small and mid-sized businesses can strengthen their security posture and build good habits that stick.
Pat started out in IT at Alfred State, where he picked up a minor in information security and assurance when it was added. He spent five years at IT providers around the region, then managed IT for a nonprofit that serves every county in Western New York. Next came four years of compliance assessments at an accounting firm.
All that experience prepared Pat to start InfoSecurity Blueprint. Today, he helps businesses get the security advice and guidance most of them may not have in-house. He’s also stepping in as interim director of Canisius University’s cybersecurity program.
We covered how attackers actually get into a business, why AI is making old weaknesses easier to exploit, and how it lets hackers personalize phishing attempts. We also talked about the policies every business needs and why passkeys might be the rare security upgrade that helps your team move faster.
Whether you run a small business or you’re thinking about a career in cybersecurity, there’s a lot here you can use right away:
Start with an inventory: You can’t assess risk on systems you don’t know you have. Pat treats AI like any other piece of business software: know what it connects to, who has access, and what data goes into it.
Act as if someone’s already in: Attackers often sit quietly in a network for weeks or months before they strike. Layered defenses and tight access controls keep one stolen password from turning into a full-blown incident.
Reward good habits: You don’t want to make people scared for their jobs. Pat recommends against punitive actions for phishing, instead suggesting a monthly raffle to reward those who completed training or didn’t click. Through positive reinforcement, your team becomes part of the defense.
Slow down, and think about passkeys: AI-crafted phishing is getting harder to spot, especially for executives and people in finance and IT. Pausing to ask “Am I expecting this?” goes a long way. Passkeys add security and remove friction from signing in.
Enjoy the chat with Patrick, and I’d love to hear your feedback on the show, and on who you’d like to hear from in the future!
You can connect with Patrick on LinkedIn and follow InfoSecurity Blueprint for more of his tips.