Your IT team tells you everything is fine.
Your computers are working. Your Microsoft 365 is working. Your firewall is working. Your backups are running. So you assume you’re secure.
But here’s the uncomfortable question: What if you’re not?
This isn’t an attack on your IT team. In fact, your IT people may be doing an excellent job.
The problem is that IT and cyber security are not the same thing.
IT keeps the business running
Your IT team has a job to do. They make sure people can work, systems are available, devices are configured and users can access what they need. The tech problems get fixed, software is deployed and networks are operational.
That’s important.
Cyber security asks a different set of questions.
- Who is accessing those systems?
- Is that access legitimate?
- What is that user actually doing?
- Would we know if their credentials had been stolen?
- What happens if someone gets around the controls we already have?
- Who is watching at 2am?
Those are security questions and they require a different discipline.
The false sense of security
This is where businesses can get lulled into a false sense of security.
An IT provider says: “You’ve got a firewall.”
So you think you’re protected.
You’ve got endpoint protection.
You’ve got Microsoft 365.
You’ve got backups.
Maybe your IT provider has even sold you an outsourced MDR service.
So you think: “We’ve got cyber security covered.”
Having security technology isn’t the same as having security visibility.
Deploying that shiny MDR product isn’t automatically the same thing as having a security operations capability watching the business.
That’s an important distinction.
The product can generate the alert.
Someone still needs to understand what is happening, determine whether it matters, investigate it and respond appropriately.
The attackers don’t care about your IT checklist
This is where the threat has changed. Attackers aren’t necessarily trying to smash through your firewall. They use stolen credentials and log in. They hijack an account or compromise your supplier. They could already be inside an email account. They use legitimate tools and move quietly through your cloud services.
Increasingly, AI is helping attackers automate and accelerate parts of this process. Verizon’s 2026 DBIR reports that 15% of the attack techniques it observed were being augmented by generative AI. (Verizon)
The attack doesn’t have to look like an attack.
The attacker can look like a legitimate user.
That’s why simply knowing that your systems are working isn’t enough.
This isn’t IT versus cyber security
I don’t want this article to be misunderstood.
Your IT team is not the enemy.
We work with IT teams every day and the best relationships are exactly that:
IT + Cyber Security = Availability and Protection.
Your IT team understands your environment.
- They know your systems.
- They know your users.
- They understand how the business operates.
A specialist cyber security team brings something different.
- Threat intelligence.
- Security monitoring.
- Detection.
- Investigation.
- Threat hunting.
- Incident response.
- Security expertise.
Importantly, cyber security provides the ability to look at what’s happening from an attacker’s perspectiverather than simply asking whether the technology is functioning.
The two disciplines complement each other. We shouldn’t compete.
The numbers tell a different story
The reason this distinction matters is simple. Businesses continue to suffer breaches despite having IT teams and security tools.
Verizon’s 2026 DBIR analysed thousands of incidents and found that vulnerability exploitation had become the leading initial access vector, accounting for 31% of breaches. It also identified credential abuse, phishing, third-party compromise and other attack paths as significant parts of the current threat landscape. (Verizon)
So the question shouldn’t be: “Do we have IT?”
Of course you do.
The question should be: “Do we have the ability to see, understand and respond when someone is attacking our IT?”
Those are very different questions.
Your IT team doesn’t need to become a SOC
This is where I think businesses sometimes make the wrong choice.
They assume that if they have IT, their IT people should simply take on cyber security as well, but cyber security is an increasingly specialised discipline.
You wouldn’t necessarily expect your financial controller to become your forensic accountant and you shouldn’t necessarily expect your IT team to build and operate a 24×7 security operation.
That doesn’t mean they aren’t capable.
It means they have a different job.
Security isn’t a tick-box exercise
Cyber security is about bringing the pieces together.
- Seeing what is happening.
- Understanding the risk.
- Detecting something unusual.
- Investigating it.
- Responding quickly.
- And continuously improving.
That’s cyber resilience.
Ask your IT team a different question.
Don’t ask: “Are we secure?”
Ask: “If someone logged into our business using a stolen account tonight, how would we know?”
And then:
“Who would investigate it?”
“Who would respond?”
“How quickly?”
Those answers will tell you considerably more about your cyber security than whether your firewall is showing green.
IT keeps your business running.
Cyber security helps make sure someone else isn’t running it.
And the two work best together.
