What We Learned About Business Cybersecurity from PwC’s David Klotz and His Team

A suspicious email, an unfamiliar login or a payment request that looks legitimate can quickly become a business problem. For an owner, the questions are immediate: Can we keep operating? Is our information safe? Who knows what to do next?

At the October 22 briefing hosted by Coastal Authority Group at Town Center City Club in Virginia Beach, David Klotz and his PwC team helped us look at cybersecurity with a much clearer understanding of those stakes. We came away with practical lessons about the exposure smaller companies face, the importance of a coordinated response and the ways AI is changing security operations.

We also learned about PwC’s capabilities, including its Unified Detection and Response offering enabled by Google Security Operations. Following the event, David shared material that connected the discussion to specific services and questions business owners can bring to their own teams.

A smaller company can still have a lot at stake

One of the most valuable takeaways was that company size alone is a poor way to judge cyber exposure. The Federal Trade Commission’s small-business guidance makes the point directly: criminals target companies of all sizes.

Consider a few hypothetical local situations. A Virginia Beach professional-services firm loses access to client files. A Norfolk logistics company cannot reach its scheduling system. A Chesapeake contractor receives fraudulent instructions to change a supplier’s bank details. Each situation could interrupt work or put money and relationships at risk.

For us, that made the discussion especially relevant to Hampton Roads. Owners can begin by asking which systems keep their business running, what information they hold and how long they could operate without access. Those answers make a security conversation much more concrete.

Knowing who responds matters as much as receiving an alert

David’s follow-up material highlighted gaps that are easy to recognize: limited coverage outside business hours, disconnected tools, too many alerts and unclear responsibility for taking action.

That prompted an important question for any business: If something suspicious happens tonight, who is watching, who investigates and who can act?

An owner may have an excellent IT provider and still need to clarify whether the agreement includes continuous security monitoring and incident response. Written responsibilities help everyone understand where routine support ends and specialist work begins.

The NIST Small Business Quick-Start Guide provides a useful starting point for that conversation. Its guidance includes identifying critical systems, assigning responsibilities, monitoring for suspicious activity and preparing for recovery. It also recognizes that outside providers can help organizations with limited internal resources.

What we learned about PwC and Google’s offering

PwC describes Unified Detection and Response, or UDR, as a managed service that brings threat detection and response, vulnerability management, incident response and penetration testing together using Google Security Operations. Its public announcement describes continuous monitoring, AI-assisted workflows and tiered pricing based on covered assets. Read PwC’s overview.

David’s sheet helped translate those capabilities into business questions:

• Monitoring and response: Who investigates suspicious activity and coordinates action?
• Security engineering: How are detections configured and improved for our environment?
• Vulnerability management: Which weaknesses should our team address first?
• Incident support: What specialist help is available when something goes wrong?
• Penetration testing: How can controlled testing reveal weaknesses before an attacker exploits them?

We found the connection between those functions particularly useful. Owners should be able to understand how a warning becomes an investigation, how findings reach the right people and who helps resolve the underlying problem.

AI brings two different security conversations

David’s follow-up overview helped us separate two related questions: using AI in cybersecurity and securing the AI a business uses.

The first concerns helping security teams analyze information, prioritize work and automate parts of their operations. The second concerns the company’s own AI tools: what data they can access, what actions they can take and how their behavior is monitored.

PwC’s supplied capabilities overview addresses both, alongside governance, testing and ongoing management of AI agents. These are broader capabilities; a company should confirm which are included in any proposed engagement.

For an owner introducing AI into customer service, administration or internal workflows, a useful question is: Who remains accountable when an AI tool handles sensitive information or takes an action?

Evaluate the full cost and the right fit

We also came away interested in how a coordinated service could simplify a company’s security arrangements. PwC presents its UDR model as a way to improve cost efficiency and make spending more predictable. Whether it saves a particular business money requires a comparison of the actual proposal with existing costs and responsibilities.

Before choosing a service, ask:

1. Which devices, cloud accounts, systems and locations are covered?
2. What counts as a billable asset, and is there a minimum commitment?
3. What response work, testing and onboarding are included or charged separately?
4. How will the service work with our existing IT provider?
5. Which current costs could it replace, and what work remains with our team?

A smaller business may need a different level of support from a company with multiple locations or complex systems. The right discussion starts with exposure, staffing and budget.

Turn the lessons into a practical next step

David and his team gave us a more informed way to approach cybersecurity. A useful next step is to sit down with the people responsible for your technology and review access controls, multifactor authentication, updates, tested backups and the incident-response plan. NIST’s guide can help structure that review.

Bring the unanswered questions to a qualified provider. Understanding the gaps makes it easier to choose support that fits the business and to know what that support should deliver.

Continue the conversation with David

To learn more about PwC’s cybersecurity and AI capabilities, or discuss whether its Unified Detection and Response offering fits your organization, contact:

David M. Klotz
Managing Director, PwC
Threat Detection & Response · Engineering | Operations

Email David · Call 571-308-2400

This article reflects CVA’s takeaways from the Coastal Authority Group-hosted event, with service details checked against PwC’s materials and practical guidance from the FTC and NIST. Sources reviewed November 2, 2026.