Many small and medium sized companies are missing the boat in terms of their IT security. In an area where there is expert knowledge required, many IT generalists are put to use. A rethink is needed. The first steps towards a change are underway, but many IT departments are still fighting an uphill battle.