Small businesses often don't have the budget for decent infosec.
At the lower end of the market there is so much upsell it's crazy. So even if they do invest they feel as though they haven't got as much security in place as they could have because they're not paying the £25 per end point per month for the "premium" features.
Not only that, a lot of smaller businesses won't hire an infosec professional to look over their setup. Usually in the advice of their "IT guy". Probably because the IT guy doesn't want all of his dirty secrets exposed.
Well fun fact IT guys. Us infosec folk understand your situation, we know the corners you're forced to cut and we generally don't expose you to the client. That's not our job.
Our job is to work with the technical staff...at least that's the way I see it...which is a damned sight easier than what you do...we don't have to deal with Betty from Accounts for the 89th time about that fucking label printer, we deal with Dave in IT...we look at your firewall rules, patching strategy, security policies and we help you tighten them up in accordance with your budget and the way the business operates...then have a beer afterwards...in fact we might be the only suppliers that will buy you beer!
So relax, we're not here to steal your job, make you look bad or undermine you...we're here to take some weight off.