Amanda and Raffi cover why the biggest losses often start with routine decisions rather than sophisticated hacks. Examples include a wire request that looks legitimate, an assistant's inbox, or a home network shared by the whole household. They also discuss a common misconception: that a company's commercial cyber policy protects the owner's family and household. Amanda explains how coverage limits get set without anyone mapping how money actually moves, and what happens when an insurance application says "yes" to a control that's only partly in place.

The thread running through the episode is governance. Insurance, IT and leadership all have to agree on the facts, and someone has to own the program. For business owners, this is protecting the vault from both sides of the table.

This week on the Cybersecurity Cafe Podcast, we sit down with Stephen Franklin, Founder and CEO of NetWatch.AI, whose own team ran into this problem head-on while building the company's newest technology: valuable time gets lost every time a person has to manually connect an alert in one system to suspicious activity in another. That gap — between noticing something and actually stopping it — is where businesses stay exposed, even when they're confident they've checked the box on security.

Stephen's own path here wasn't conventional either. He earned his computer science degree at night while working full time, got laid off, and was recruited back by former colleagues before eventually holding a patented piece of technology built to close that exact gap.

We talk through where small businesses tend to overestimate their protection, what actually changes when a machine — not a person — connects the dots, and the one thing a business owner should do differently starting Monday morning.

In this episode, Stan and Raffi dig into how buyers price cyber posture into an acquisition, what financial-viability questions every business owner should be asking their IT provider, and how to actually put a dollar figure on cyber risk instead of treating it as an abstract threat. They also tackle a question every CFO is fielding right now: is AI spend cannibalizing cybersecurity and SaaS budgets, or is it genuinely net-new investment?

Stan closes with the core idea behind his book, Run the Business, Don't Become It — a reminder that the same strategic discipline that prevents founders from getting consumed by day-to-day firefighting is exactly what protects a business's long-term value, cyber risk included.

If you've ever wondered whether your security spend is actually building enterprise value — or just checking a box — this conversation reframes the question.

After nearly three decades running a systems integration firm serving small and mid-sized businesses, Maxwell has watched the same pattern play out again and again — a company runs on one person, one account, one set of credentials, and never questions it until a single phishing email or compromised login brings the whole operation to a halt in minutes. His core argument isn't really about technology at all. It's about cash flow, client trust, and business continuity — the things an SME actually stands to lose, and the reason most owners don't think they're a target until it's already too late.

In this conversation, we dig into that reframe: why treating cybersecurity like a dividend-generating asset changes the decisions owners make, what a single point of failure looks like inside a real business, and the smallest, cheapest steps that actually move the needle — no jargon, no fear-selling.

Link to book: Cyber Model Dividends

With a background at Morgan Stanley and HSBC and a firm that helps startups and emerging funds raise capital, Jeffrey brings an investor's lens to security. We dig into how cybersecurity actually shows up in due diligence, what a company's security posture signals to a serious investor, and the gaps that quietly kill deals. He explains why founders who frame security as a cost center may be hurting their own fundraise—and how to talk about it as an asset instead.