{"id":184109,"date":"2026-02-03T10:00:00","date_gmt":"2026-02-03T15:00:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/02\/03\/how-to-bake-cyber-resilience-into-your-startup-culture\/"},"modified":"2026-02-03T10:10:09","modified_gmt":"2026-02-03T15:10:09","slug":"how-to-bake-cyber-resilience-into-your-startup-culture","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/02\/03\/how-to-bake-cyber-resilience-into-your-startup-culture\/","title":{"rendered":"How to bake cyber resilience into your startup culture"},"content":{"rendered":"

How to bake cyber resilience into your startup culture<\/a><\/p>\n

https:\/\/mitsloan.mit.edu\/ideas-made-to-matter\/how-to-bake-cyber-resilience-your-startup-culture<\/a><\/p>\n

Publish Date: 2026-02-03 10:00:00<\/a><\/p>\n

Source Domain: mitsloan.mit.edu<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

Keri Pearlson listened intently to renowned business leaders presenting at the featured session of the 2025 South by Southwest conference on what America\u2019s 33 million small businesses needed to do to prosper. One topic of particular interest to Pearlson never came up: cybersecurity. It wasn\u2019t the first time. At other business conferences and in other conversations with everyone from CEOs to founders, cybersecurity typically emerged as a secondary concern, if at all. <\/p>\n

Pearlson is a principal research scientist at MIT Sloan whose\u00a0research on small to midsized companies has identified a false sense of security among their leadership. \u201cThe problem is, they think cybercriminals are targeting larger, well-established companies in part because these are the type of cyberattacks \u2014 the ones that impact an extensive customer base \u2014 that are covered by the media. They don\u2019t think of themselves as potential targets.\u201dBut Pearlson says their smaller size is often the very reason why they\u2019re targeted \u2014 in particular, small to medium-sized businesses that make up larger companies\u2019 supply chains are often viewed by cybercriminals as vectors to infect the systems of larger, harder-to-access companies.One\u00a0study [found] that small businesses account for 43% of cyberattacks annually, and 46% of [those] cyberattacks were against small businesses with 1,000 or fewer employees. On average, small and medium-sized businesses lose $25,000 [per incident] due to cyberattacks. In 2020, small businesses faced over 700,000 attacks, which caused a total of $2.8 billion in damages. Such damage can ultimately lead to failure.According to Pearlson, the lack of attention to cybersecurity is exacerbated by a prevailing attitude that cybersecurity should be relegated to the IT department and a belief that artificial intelligence can protect against all cyberattacks.\u201cAn IT department can\u2019t keep an employee from clicking on a malicious link,\u201d says Pearlson. \u201cAnd while AI promises to make it easier to identify malicious activity, you have to remember that the bad guys have AI too. They\u2019re determined to find a way around just about any defense we create to stop them.\u201d <\/p>\n

Because cybercriminals are always evolving their methods and techniques, Pearlson stresses the importance of building a cyber preventative and resilience culture. \u201cCybersecurity is everyone\u2019s issue, which is why it\u2019s so important for companies at all stages of growth to develop a cybersecurity culture as their first line of defense against cyber breaches,\u201d she says.Startups, Pearlson notes, hold an advantage in this area. Whereas processes may already be in place and habits formed at established companies, startup founders have an opportunity to implement a cyber-savvy culture from the ground up.To best protect your company, customers, employees and investors, founders need to assume the role of \u201cchief security officer.\u201d According to Pearlson, here\u2019s how:Create a cybersecurity crisis communications planThe early stages of a cyber crisis are often chaotic, with customers, partners, investors, and reporters, among others, demanding answers. By creating your plan in advance, you are better positioned to pivot and move quickly. Elements to consider in its creation are:How will you reach clients if your email is down?Which stakeholders will you need to contact?Who should you contact at your local and national law enforcement agencies? For example, do you know the number of your local FBI field office?If you lose your data, who do you contact and who is responsible?Are there any responses you can craft in advance to use as a template in the event that reporters contact you?<\/p>\n

Leading Technical Professionals and Teams
\n In person at MIT Sloan
\n Get information<\/p>\n

Hold fire drillsBusinesses regularly hold fire drills to ensure that work staff know what to do in the event of a fire or natural disaster. In a cyber-drill, simulate a cyberattack \u2014 case studies on cybersecurity breaches can help in this area \u2014 and have everyone act out their assigned roles. Then, simulate your step-by-step recovery.\u00a0Buy cyber insuranceContact your insurance company to find out whether it offers any form of cyber insurance. If it doesn\u2019t, consider looking into cyber insurance policies to determine if it\u2019s worth the investment.\u00a0Back it up old-school stylePearlson\u2019s research uncovered a company that created a robust business continuity plan for a cyber crisis. But after it was hacked, no one was able to get online to access the plan.As panic built, an administrative assistant clutching a folder approached her director. She asked, \u201cIs this the plan?\u201d Up until then, she\u2019d been teased by colleagues about her habit of making hard copies of important documents. Now, she emerged as the company\u2019s hero.Make it a habit to save key documents to a thumb drive, email them to yourself, and print them so you have multiple ways to access them in an emergency.Reward cyber heroes\u00a0Host a competition among your staff to see who can figure out real from fake links, documents, vendor invoices, and emails. This will help employees learn to pay attention to small irregularities, like a minor misspelling in a website address, or clues to identify an email\u2019s origins. Then reward those employees who do well.\u00a0Host cybersecurity momentsPearlson once consulted on a cybersecurity plan with a bank in Brazil where the CEO would start every meeting with a \u201ccybersecurity moment.\u201d These moments included his sharing media coverage on, or social media posts about, cybersecurity attacks, practices, and solutions.\u201cThe CEO is sending the message that cybersecurity is something their business talks about,\u201d says Pearlson. \u201cAs chief security officer, you set the stage for building a cyber-savvy workforce.\u201dExcerpted with permission from the publisher, Wiley, from\u00a0\u201cUnlikely Entrepreneurs: Wins, Losses, and Crucial Lessons on Building Great Companies,\u201d by N. Louis Shipley and Patricia Favreau. Copyright \u00a9 2026 by Lou Shipley and Patricia Favreau. All rights reserved.\u00a0N. Louis Shipley\u00a0is a former three-time software CEO and a senior lecturer in the Entrepreneurial Management unit at Harvard Business School. He previously lectured at MIT Sloan. Shipley serves as a board director at Wasabi Technologies, Fairmarkit, and CustomerGauge and is a founding donor to the Trinity College Entrepreneurship Center.Patricia Favreau\u00a0is associate director of media relations at MIT Sloan, where she dissects complex academic research to make it accessible to business audiences around the globe. She began her career as a news correspondent and holds an MFA in creative writing from Lesley University.<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

How to bake cyber resilience into your startup culture https:\/\/mitsloan.mit.edu\/ideas-made-to-matter\/how-to-bake-cyber-resilience-your-startup-culture Publish Date: 2026-02-03 10:00:00 Source…<\/p>\n","protected":false},"author":1,"featured_media":184110,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/mitsloan.mit.edu\/sites\/default\/files\/styles\/og_image\/public\/2026-01\/startup-cybersecurity_1.jpg.webp?h=1c0fe72e&itok=XT55zDMq","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,20,24],"class_list":["post-184109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-artificial-intelligence","tag-cybersecurity"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/184109"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=184109"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/184109\/revisions"}],"predecessor-version":[{"id":184111,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/184109\/revisions\/184111"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/184110"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=184109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=184109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=184109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}