Of all the cybersecurity myths about small to midsized businesses, the most damaging is the widely held believe that SMB leadership doesn’t take security and data privacy seriously, says Wolfgang Goerlich, Advisory CISO at Cisco Duo. This myth must be stamped out immediately, he said. And while it’s myth No. 8 in a new Cisco report, “it really needs to be myth one.”

“Maybe that was true 10 years ago,” Goerlich said. “The executive teams of these organizations are taking security and data privacy very seriously. Every other myth downstream is effected by that awareness and visibility at the top.”

Cisco’s latest security report, based on a survey of almost 500 SMBs, aims to debunk myths about smaller companies’ security posture and threats. This is important because the security industry has traditionally been biased against SMBs, perpetuating the myth that they don’t prioritize cybersecurity, the report says.

To come up with the 10 myths debunked in the report, Cisco compared responses from SMBs (250-499 employees) versus larger organizations with 500 or more employees. Much of this data comes from the vendor’s annual CISO Benchmark report. It shows that SMBs face the same threats and potential damages from an attack and they take security preparedness every bit as seriously as their larger counterparts.

“SMB executives, IT executives, security executives in these businesses have done their best to address the problem,” Goerlich said. “They have made investments, have made hires, have invested in technologies. They’ve really done a lot to move the needle forward.” What this means is that SMB IT and security leaders now have to ask themselves what’s next, he added. “Where do I go from here?”

To answer this question, smaller businesses need to consider threats, downtime, and security tools, Goerlich said.

Cisco compared the types of attacks that SMBs and large enterprises reported experiencing in the past year, and how much downtime these attacks caused. Ransomware was most likely to cause more than 24 hours of downtime for SMBs, as well as for businesses with 1,000 or more employees. Malware, on the other hand, was at the bottom of the list for SMBs.

“But yet, if you talk to a lot of the people in these companies, malware is the first thing they think about,” Goerlich said. “One thing is to look at the security efforts, both in terms of time and spend, and make sure they are aligned with the actual threats the business is facing to better allocate the budget and the efforts to provide better defense.”

And while complex security environments and vendor fatigue is an area that plagues the entire industry, it appears that SMBs feel this pain more acutely than their larger counterparts. Cisco found the more vendors that SMB survey respondents used, the longer their reported downtime from their most sever breach. This ranged from an average of four hours of lost businesses time for SMBs using one vendor to an average of more than 17 hours downtime for those using more than 50 vendors.

“That’s a huge difference in outages,” Goerlich said. “Hours for SMBs translate directly into revenue. The more tools you have, you would think you would have better security. But in fact, the more tools you have, you’re creating more confusion. My advice would be to have a tools rationalization effort in place. Look at security as a set of capabilities — not a set of vendors and tools — and work with trusted partners to figure out what is the best way to satisfy those capabilities.”

Some of the other myths that the report debunks:

SMBs lack personnel dedicated to security. In fact, Cisco says less than 1% of SMBs said they didn’t have anyone dedicated to security. And 60% said they have more than 20 people dedicated to security.

SMBs don’t proactively perform threat hunting. Cisco found 72% have employees dedicated to threat hunting, and this is close to the same percentage of large organizations with a threat hunting department.

SMBs don’t regularly patch vulnerabilities. While 58% of large businesses patch daily or weekly, so do 56% of SMBs, the report says.

Goerlich likes this last one in particular because at just about every cybersecurity conference someone stands up on stage and shouts “don’t click stuff and patch your stuff! So it was very refreshing to see that smaller organizations are indeed keeping up with their patches.”

As a whole, the report reveals that SMBs have made substantial progress over the past several years. “People leading the charge should definitely feel good about that,” Goerlich said. “And at the same time we’ve reached a point where the shift needs to be away from building out [security portfolio] capacity and toward optimizing capabilities.”