Is it possible to protect information when resources are scarce? – #02 STRONG POINT.

Is it possible to protect information when resources are scarce?

Information Security begins with risk management and the management of available resources.

Information is one of the most valuable assets of any organization today, regardless of its size or industry. All organizations rely daily on the availability, integrity, and confidentiality of their data to maintain their operations, protect their customers, and safeguard their reputation. But although everyone recognizes the importance of cybersecurity and information protection, the reality is that most organizations continue to face a common problem: a shortage of resources.

When people talk about scarce resources, they often think only of a lack of budget. However, the reality is much broader: there is a shortage of specialized professionals, a lack of time to implement security measures, a lack of technical expertise within organizations, and, often, even a lack of risk awareness on the part of management. Protection does not mean completely eliminating risk. No organization, regardless of the size of its investment, can guarantee absolute security. The goal of Information Security has never been to prevent incidents, but rather to reduce the likelihood of their occurrence and minimize their impact. This paradigm shift is essential to understanding that risk management is far more important than simply acquiring technology.

The most serious incidents in recent years demonstrate that multimillion-dollar budgets alone do not guarantee information security. Several technologically advanced organizations have suffered devastating attacks despite their substantial investments. In many cases, the cause was not a lack of technology, but rather human error, flawed processes, or poor management decisions. Interestingly, some small and medium-sized businesses manage to achieve higher levels of maturity than large organizations by making the most efficient use of their available resources. Rather than implementing every available measure, they focus on what truly reduces risk.

Any organization’s first investment must be in raising awareness among its people. We continue to see situations where employees click on phishing messages, reuse passwords, share credentials, or send confidential information through insecure channels. Ongoing training is therefore one of the investments with the highest return in the area of Information Security. And, contrary to popular belief, it doesn’t have to be expensive: short sessions, awareness campaigns, phishing simulations, and small internal communication initiatives can significantly change organizational culture.

Another common mistake is believing that protecting information requires purchasing the most sophisticated technological solutions on the market. Of course, technology plays a key role, but only if it addresses the risks that have been effectively identified. An organization with limited resources benefits far more from having tested backups, multi-factor authentication, a sound access management policy, regular system updates, and basic Cyberscan-type monitoring of its assets than from investing in more complex solutions that it will likely struggle to configure, manage, or maintain. In Information Security, well-implemented simplicity often trumps poorly managed complexity.

Risk-based management is another essential principle. When resources are scarce, it becomes impossible to protect everything with the same level of priority. This is precisely why international standards such as ISO 27001 or risk management methodologies such as ISO 31000 advocate an approach based on identifying critical assets and the most significant risks. Not all information has the same value. Not all systems have the same impact on the business. Not all processes require the same level of protection. Knowing how to identify what is truly critical allows you to direct available resources to where they produce the greatest benefit.

Another aspect that is often overlooked is the importance of incident response preparedness. Many organizations focus all their efforts on prevention and forget to prepare for the response when, inevitably, an incident occurs. Having defined procedures, teams with clear responsibilities, up-to-date contacts, communication plans, functional backups, and periodic drills can drastically reduce recovery time after a cyberattack. Resilience is just as important today as prevention: an organization’s resilience is measured not only by its ability to prevent attacks, but also by how quickly it recovers. Resource constraints can, moreover, spur innovation. The need to do more with less favors automation, shared services, cloud computing, and the adoption of simple, mature, and well-maintained tools capable of providing high levels of security at reduced costs. Their effectiveness, however, depends on choosing reliable solutions, regular updates, and proper management. Above all, this context requires decision-makers to continually assess where every euro invested can most effectively reduce risk.

In the coming years, challenges such as artificial intelligence, the growing sophistication of attacks, the proliferation of Internet-connected devices, and increased regulatory requirements—such as the NIS 2 Directive—will significantly increase the pressure on organizations of all sizes. However, these developments do not mean that only those with large budgets will be protected. The real difference will continue to lie in the quality of leadership, organizational culture, risk management, and the ability to make informed decisions.

Ultimately, protecting information when resources are scarce is not only possible—it is an absolute necessity. The question is not how much money an organization has to invest, but rather how it chooses to invest the resources it has available. Information security does not begin with technology. It begins with knowledge, planning, accountability, and commitment. These are the resources that, even though they are intangible, yield the greatest return and enable the creation of truly resilient organizations.

In a context where threats evolve daily and resources are unlikely to keep pace, it will not be the organizations that spend the most that will succeed, but those that best understand that security is, above all, a matter of intelligent risk management and the judicious use of available resources.

Click here to subscribe to the STRONG POINT newsletter, available on our LinkedIn page.

Vasco Martins dos Santos – Director of Risk Consulting.