At the CanadianSME Small Business Summit in Toronto, Pat Finerty of Peloton Technologies said something about security that had nothing to do with software.
Whoever owns security and compliance needs the hammer. If sales, marketing, or even the founder says "just do it" and compliance hasn't signed off, it doesn't happen.
That's an operations idea, not an IT idea. And most small firms don't have it.
In a ten-person firm, the founder makes the call on everything. That's a strength until the call is "skip the step, we're in a hurry." Then the person with the most authority is the person most able to bypass the control.
Scott Maring of Fortinet added the second half of the problem: when a control gets in the way of the day's work, people build workarounds. A rule nobody owns gets quietly routed around.
It's Cybersecurity Awareness Month, so here's the ops version of the question: who holds the hammer in your firm?
Three things to settle:
- Name the owner. One person, not "everyone." In a small firm, that may be a part-time role or a trusted outside partner.
- Write down what the founder can't override. Keep it short: turning off multi-factor sign-in, pasting client data into public AI tools, skipping a backup test.
- Make the safe path the easy path. Simple controls get followed. Heavy ones get dodged.
Try it this week: finish one sentence. "[Name] decides, and I can't overrule them on [list]." If you can't finish it, that's your first project.
Ideas shared by Pat Finerty (Head of Strategy and Partnerships, Peloton Technologies) and Scott Maring (Director, Presales Security Engineering, Fortinet) on the "Building the Digital Backbone" panel at the CanadianSME Small Business Summit 2026.
If you can't name who holds the hammer at your firm, that's an ownership gap. Message me and we'll talk through what fixing it would take.