Last Updated: October 25, 2026
Every security sales demo I have ever watched contains the same scene. The lights dim a little, someone shares their screen, and a dark map of the world fills with glowing red lines. Attacks, we are told, happening right now. Arcs fly from one continent to another like a fireworks show designed by an insurance salesman. Everyone in the room leans in. Nobody asks what any of it has to do with the twelve laptops in their office.
That map is theatre, and it works beautifully, because fear is easier to sell than maintenance. But if you run a small business and you are shortlisting cyber security companies in Calgary to hire, or anywhere else for that matter, the more useful question to ask in the sales meeting is what happens after the projector turns off. Who patches your machines on a Tuesday? Who notices that the former bookkeeper still has a working login?
Table of Contents
The demo sells the dramatic, the incident comes from the dull
Here is the uncomfortable part. The incidents that actually hurt small businesses are rarely cinematic. They tend to start with something embarrassingly ordinary: a password reused from a breached shopping site, a remote access tool left open after a vendor finished a job, an email account with no second factor, a laptop that has been politely postponing updates since spring. None of that looks good on a giant screen. All of it is fixable.
The red map implies that your problem is the scale and sophistication of the attackers. Usually your problem is a door you forgot you left unlocked. A sophisticated attacker does not need to be sophisticated with you if the basics are missing, and most opportunistic attacks are aimed at exactly those gaps.
So when a vendor spends forty minutes on threat intelligence and four minutes on how they handle patching, I start to wonder which part of the job they actually enjoy.
What boring looks like when it is done well
The basics are not glamorous, but they are specific, and specificity is the tell. A provider who takes them seriously can explain, without slides, how they handle each of these:
| The flashy pitch | The boring question that matters |
| “AI-powered threat detection” | How fast do critical patches reach our machines, and who checks they installed? |
| “Global attack visibility” | Who reviews which accounts still have access, and how often? |
| “Next-generation firewall” | Are our backups tested, and when did someone last restore from one? |
| “Zero trust architecture” | Will you help us set up strong multi-factor authentication on email and remote access? |
Notice that none of the questions on the right require a single buzzword. They require someone to do the work every month and be able to show you that they did. A good provider can tell you what they patched, what failed, and what they are chasing. A weak one can tell you how many threats were “blocked” globally, which is a number about the internet, not about you.
Why the theatre persists
Part of it is that buyers reward it. A business owner who sits through a scary demo walks away feeling like they did something responsible. A business owner who hears “we will make sure your updates install and your old accounts get shut off” feels like they bought a janitor.
But think about how you would judge any other trade. You would not hire a plumber because they showed you an animated map of global pipe failures. You would want to know if they show up, fix the leak, and tell you what else is about to go. Security deserves the same plain standard.
A better way to sit through the next demo
You do not have to be rude about it. Let them show the map. Then ask to see what a normal month of their work looks like for a business your size. Ask who you call when something feels off, and whether a person answers. Ask what they would fix first in your environment, and whether that answer changes after they have actually looked at it. If the answer is a product rather than a process, you have learned something useful.
The best security conversations I have heard were almost boring to sit through. They were full of words like “updates,” “access reviews,” and “restore test.” Nobody dimmed the lights.
If your current setup looks impressive in a meeting but you cannot say when your backups were last tested, that is the place to start, not the map.
