What Changes When a Business Can Assemble Its Own Security?
The price and the person doing the work both change, and the analogy carries the point. Something bespoke is measured, built and installed for you, and it costs what that takes. A flat pack is standard, affordable, and put together by whoever bought it. Gaurav's argument on the show is that most smaller businesses were only ever offered the first one, and what they actually need is the second.
How far that model stretches, and what it takes to make security something a non-specialist can genuinely operate, is the substance of the interview. Also in the conversation: why he left two decades in Singapore's national cyber security and defence organisations for the small-business end of the market.
Where Can I Listen to the Full Episode?
The episode runs 39 minutes and is on BFM's website, alongside the rest of the Open For Business archive.
- Building the IKEA of Cyber Security for SMEs, BFM 89.9, 4 August 2026
- Open For Business, the show page, presented by Audrey Raj
Related Reading
- Spotlight: A startup trying to IKEA-ify cybersecurity for SMEs, the Tech in Asia profile built on the same analogy.
- Think you're safe from cyber crooks?, Gaurav on The Straits Times podcast on why so many companies remain exposed.
Frequently Asked Questions
Who is the guest on the BFM 89.9 episode about the IKEA of cyber security?
Gaurav Keerthi, CEO and co-founder of StrongKeep. Before founding it he was Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and Chief Information Officer of the Republic of Singapore Air Force. The episode was presented by Audrey Raj on Open For Business, BFM 89.9's enterprise programme, and published on 4 August 2026.
What does the phrase "the IKEA of cyber security" actually mean?
It is a comparison, not a product specification. Bespoke security is specified, built and operated by specialists, and priced for organisations that employ them. The IKEA comparison points the other way: standard parts, an affordable price, and assembly by the business that bought it. Gaurav sets out the argument in the episode.
Are smaller businesses really targeted by ransomware?
Yes. Verizon's 2025 Data Breach Investigations Report found ransomware was a component of 88% of breaches at small and medium-sized businesses, against 39% at large organisations. Its authors write that ransomware groups "don’t seem to care what size an organization is; they are quite happy to breach smaller organizations and adjust their ransom demands accordingly."
Why did StrongKeep's founder leave a national cyber security role to work with small businesses?
Gaurav Keerthi spent more than two decades on security problems, latterly as Deputy Commissioner for Cybersecurity and Deputy Chief Executive at Singapore's Cyber Security Agency, and before that as an Executive Vice President at Ensign InfoSecurity. His own account is that the smallest organisations were consistently the least protected, and that setting up a tech-for-good charity in Singapore showed him how hard it is for a small organisation to protect sensitive data. He founded StrongKeep in 2025, building on work that began at Ensign InfoSecurity in 2023.
Which small businesses need this most?
Businesses with no dedicated security team, which face the same attacks as large firms without the budget, tools or expertise to answer them. Three situations recur in Gaurav's account: firms pushed into cybersecurity by tender requirements from larger customers; firms holding sensitive client data, such as law, audit and HR practices, that want to show they handle it properly; and regulated sectors, where healthcare is StrongKeep's current focus. Most customers are in Singapore today.
How has AI changed the risk for a business with no security team?
It cuts both ways, and that is the part Gaurav says gets least attention. AI is what makes it possible to deliver security simply and cheaply enough for a small business to run itself. It has also given attackers more speed and scale, so a business that is not protected is likelier to be found. He names awareness as the harder problem: getting a busy owner to act before an incident rather than after one.
What Does StrongKeep Do?
StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page.
