SMBs and enterprises do not buy or operate security the same way. In Inverted Podcast #10, Tim Ehrhart joins the hosts to compare expectations, attacker targeting, and product design for small versus large customers.
The conversation covers secure defaults versus deep customization, automation and managed services for SMBs, enterprise complexity tax, supply chain and third-party risk, limiting blast radius, and designing fraud detection that works across segments.
About the guest
Tim Ehrhart, CISO at F. Hoffmann-La Roche Ltd, joins the panel to contrast security needs, resources, and attacker attention for SMBs versus large enterprises, and what that implies for product defaults, flexibility, and success metrics.
Key takeaways
- SMB and enterprise buyers differ in resources, staffing, and risk tolerance.
- Attackers also treat segments differently. Opportunistic vs targeted patterns matter.
- Secure defaults matter most where customers cannot staff full-time security.
- Enterprises pay a complexity tax for customization and integration.
- Supply chain and third-party risk hit both segments with different blast radii.
- Measure success with goals each segment can actually act on.
Topics covered
- SMB vs enterprise security needs and expectations
- How attackers target each segment
- Secure defaults and product flexibility
- Metrics and measuring success
- Supply chain, third-party risk, and blast radius
- Fraud detection design across customer sizes
Chapters
00:07 Introduction & Inverted Products
00:31 SMBs vs. Enterprises: Security Needs
02:05 Expectations & User Differences
03:19 Enterprise Complexity & Customization
06:18 SMB Security Challenges
08:03 Attackers: SMBs vs. Enterprises
11:07 Secure Defaults & Product Flexibility
13:57 Metrics & Measuring Success
17:03 Supply Chain & Third-Party Risks
20:07 Limiting Blast Radius
24:10 Designing Fraud Detection for SMBs & Enterprises
28:13 Balancing Flexibility & Usability
32:16 Closing Thoughts & Key Takeaways
For inverted product managers, the practical test is whether your roadmap reduces measurable damage for real users without inventing vanity metrics. Use the chapters above to jump to the sections most relevant to your team, then bring one concrete change into your next planning cycle.
Segment-aware design also affects packaging and success metrics. An SMB may need a managed path and opinionated defaults, while an enterprise may need integrations, policy flexibility, and audit trails. Tim and the hosts argue that pretending one configuration model serves both usually creates either under-protection for small customers or unusable complexity for large ones.
FAQ
Who is the guest?
Tim Ehrhart, CISO at F. Hoffmann-La Roche Ltd, shares how segment differences shape security product requirements.
Should one product serve both SMBs and enterprises?
Often with a shared core and different packaging: strong defaults for SMBs, deeper controls and integrations for enterprises, without making either segment suffer the other’s complexity.
How does this connect to inverted products?
Damage profiles and operating capacity differ by segment. Inverted products must match defenses to how each customer actually runs security.
Related on Inverted PM
- Podcast #5: Business Models for Inverted Products
- Podcast #9: User-Centric Security
- Podcast #14: Business Model Canvas for Security (Part 1)
- Podcast #16: Unorthodox Security
- Meet the hosts
- All Inverted Podcast episodes
Connect with the hosts and guests on the video or on LinkedIn to continue the conversation.
🎧 Find the Inverted Podcast on LinkedIn, Spotify, YouTube, Amazon Music/Audible, iHeartRadio, or invertedpm.com.
Explore more
Browse all Inverted Podcast episodes, read the blog, or meet the hosts.
Related: Episode 5 – Business Models for Inverted Products · Episode 14 – Business Model Canvas Part 1