The Colonial Pipeline Fallout Changed Everything About How We Buy Security

One year ago, a single compromised password shut down the largest fuel pipeline in the United States. Colonial Pipeline paid $4.4 million in ransom. Gas stations across the Southeast ran dry. And the FBI later confirmed that the breach started with a stolen VPN credential — no multi-factor authentication required.

That incident did something I hadn't seen in 20 years of working in this field: it made executives actually care about choosing the right computer security service. Not just buying a firewall and forgetting about it. Not just checking a compliance box. Actually caring.

But here's the problem. The market is flooded with vendors promising "next-gen" everything, and most organizations still don't know what a good computer security service actually looks like. This post breaks it down — based on real breach data, real attack patterns, and what I've seen work in practice.

What a Computer Security Service Should Actually Cover

Most organizations think security is a product. Buy the right appliance, install the right software, and you're safe. I've walked into environments where a company spent six figures on endpoint detection and still had every employee using the same password across five platforms.

A legitimate computer security service in 2022 needs to address three layers simultaneously: technology, process, and people. Miss any one of those and you're leaving a door open that a threat actor will find.

Technology: The Baseline, Not the Finish Line

Firewalls, endpoint detection and response (EDR), email filtering, vulnerability scanning — these are table stakes. They matter. But the 2022 Verizon Data Breach Investigations Report found that 82% of breaches involved the human element. That means even the best technology stack fails if your people aren't trained.

Technology controls should include multi-factor authentication on every external-facing system, network segmentation, encrypted backups stored offline, and real-time log monitoring. If your current provider isn't insisting on MFA everywhere, ask them why.

Process: Written Policies That People Actually Follow

I've reviewed incident response plans that were last updated in 2017. That's not a plan — that's a liability. A solid computer security service includes regular policy reviews, tabletop exercises, and documented procedures for incident response, access management, and data classification.

NIST's Cybersecurity Framework (nist.gov/cyberframework) remains the gold standard here. It organizes security into five functions: Identify, Protect, Detect, Respond, Recover. If your security provider can't map their services to those five functions, that tells you something.

People: The Layer Most Vendors Ignore

This is where I get blunt. You can spend a fortune on tools, but if your accounts payable clerk clicks a phishing link and enters their credentials on a spoofed Microsoft 365 login page, none of those tools saved you. Credential theft is the single most common initial attack vector in breaches today.

Security awareness training isn't optional. It's infrastructure. Organizations that run regular phishing awareness training with simulated attacks see measurably lower click rates within 90 days. I've watched organizations go from a 35% phishing click rate to under 5% in six months with consistent training.

The $4.88M Lesson Most Small Businesses Learn Too Late

IBM's Cost of a Data Breach Report 2022 pegged the average breach cost at $4.35 million globally — and $9.44 million in the United States. For smaller organizations, the numbers are proportionally devastating. A $200,000 ransomware payment plus two weeks of downtime can end a small business entirely.

The FBI's Internet Crime Complaint Center (IC3) reported over $6.9 billion in losses from cybercrime complaints in 2021 alone (ic3.gov). Business email compromise — a form of social engineering — accounted for roughly $2.4 billion of that.

Here's what I tell every business owner I work with: the cost of a quality computer security service is a fraction of the cost of a single successful attack. Every time.

What Does a Computer Security Service Cost?

This is the question everyone searches for, so let me answer it directly.

For small businesses (under 50 employees), managed security services typically range from $1,500 to $5,000 per month in 2022. That usually includes firewall management, endpoint protection, patch management, basic monitoring, and some level of incident response.

For mid-size organizations, expect $5,000 to $20,000+ per month depending on scope, compliance requirements, and whether you need a full Security Operations Center (SOC).

What's often missing from those quotes — and what you should demand — is security awareness training for your entire staff. Some providers tack on an extra per-user fee. Others skip it entirely. Don't let them. Investing in cybersecurity awareness training for your workforce is one of the highest-ROI moves you can make.

Five Red Flags When Evaluating a Security Provider

In my experience, bad security vendors share common traits. Watch for these:

  • They never mention your employees. If the proposal is 100% technology with zero focus on security awareness, they're solving half the problem.
  • They can't explain their incident response process. Ask them: "If we call you at 2 AM on a Saturday because ransomware just encrypted our file server, what happens in the next 60 minutes?" If they stumble, walk away.
  • They don't perform phishing simulations. Real security providers test your people regularly with phishing simulation campaigns. It's the only way to measure human risk.
  • They haven't mentioned zero trust. The zero trust model — "never trust, always verify" — should be foundational to any modern security architecture. If they're still relying on perimeter-only defense, they're a decade behind.
  • They don't talk about compliance. Whether you're dealing with HIPAA, PCI-DSS, CMMC, or state privacy laws, your provider needs to understand your regulatory obligations. Security without compliance alignment is incomplete.

Social Engineering: The Attack Your Firewall Can't Stop

Let me tell you what I see over and over. An attacker sends a well-crafted email to someone in finance. The email looks like it's from the CEO. It references a real project. It asks for a wire transfer to a new vendor account. The employee complies because the email "felt right."

That's social engineering. No malware. No exploit. No vulnerability scan would have caught it. The only defense is a trained employee who knows to pick up the phone and verify.

The Verizon DBIR (Verizon DBIR) has highlighted social engineering as a top attack pattern for years. In the 2022 report, pretexting — creating a fabricated scenario to manipulate a victim — nearly doubled in incidents compared to the previous year.

This is exactly why any computer security service worth paying for must include human-layer defenses. Technical controls catch technical attacks. Trained people catch social attacks.

Building a Zero Trust Foundation in 2022

Zero trust isn't a product you buy. It's an architecture philosophy. The core principle: no user, device, or network segment is trusted by default, even inside the perimeter.

In practical terms, here's what zero trust looks like for a mid-size organization:

  • Identity verification at every access point. Multi-factor authentication on every application — not just email.
  • Least privilege access. Users get access only to the systems they need for their specific role. No more shared admin accounts.
  • Microsegmentation. Your HR database shouldn't be reachable from the guest Wi-Fi. Networks should be segmented so a breach in one zone doesn't cascade.
  • Continuous monitoring. Access decisions aren't one-and-done. Behavioral analytics should flag anomalies — like a user logging in from two countries in the same hour.

CISA has published excellent zero trust guidance and maturity models at cisa.gov/zero-trust-maturity-model. If your provider isn't referencing these frameworks, they should be.

Ransomware Isn't Slowing Down — Your Defense Needs to Speed Up

Ransomware attacks increased by 13% in 2021, according to Verizon's 2022 DBIR — a jump as large as the previous five years combined. Groups like Conti, LockBit, and BlackCat dominated headlines through late 2021 and into 2022.

The playbook for most ransomware attacks follows a predictable pattern: phishing email leads to credential theft, credential theft leads to lateral movement, lateral movement leads to domain admin access, domain admin access leads to mass encryption and a ransom note.

Breaking that chain at any point stops the attack. A trained employee spots the phishing email. MFA prevents the stolen credential from working. Network segmentation limits lateral movement. Offline backups enable recovery without paying.

Every layer matters. That's why a comprehensive computer security service can't just focus on one piece of the kill chain.

What to Do This Week

You don't need to overhaul everything overnight. But you do need to start. Here are five actions you can take this week:

  • Enable MFA on every external-facing system. Email, VPN, cloud applications — all of them. This single step blocks the vast majority of credential theft attacks.
  • Run a phishing simulation. You need to know your baseline click rate. Start with phishing awareness training designed for organizations and measure where your team stands today.
  • Review your backup strategy. Are backups encrypted? Stored offline or air-gapped? Tested for restoration within the last 90 days? If not, fix that before anything else.
  • Enroll your team in security awareness training. Cybersecurity awareness training gives your employees the knowledge to recognize threats before they become incidents.
  • Ask your provider hard questions. Use the red flags list above. If your current vendor can't answer clearly, it's time to look elsewhere.

Security Is a Service — Not a Purchase Order

The organizations that survive breaches aren't the ones that spent the most on tools. They're the ones that treated security as an ongoing discipline — investing in technology, refining processes, and training their people relentlessly.

A real computer security service does all three. It adapts as threats evolve. It tests defenses regularly. And it treats your employees as the critical security layer they actually are.

The threat landscape in 2022 is the most complex I've seen in my career. Ransomware is industrialized. Social engineering is sophisticated. Supply chain attacks are on the rise. But the fundamentals — MFA, patching, least privilege, awareness training, tested backups — still stop the vast majority of attacks.

Get the fundamentals right first. Everything else builds from there.