In just over a year, LockPath has closed $9 million in funding with $6 million announced today in its series B. Why are VCs throwing money at this Kansas City-based startup that only launched in 2010? It’s making it cheap and easy for smaller businesses to manage greater risks.

Research firm International Data Corp (IDC) just released a report that predicts SMB spending on security will rapidly outpace other IT purchases over the next three years. LockPath CEO Chris Caldwell says cloud providers and app companies saddled with sensitive user data have turned to Lockpath for Software as a Service (SaaS) security management. Security as a service is usually cheaper, because it doesn’t require changing the existing IT infrastructure.

“A few years ago, it was cost prohibitive to buy this software and less startups needed it. Now, SMBs are taking a proactive view to say to auditors and investors, ‘hey, we’re doing everything we can to secure customer’s data,'” says Caldwell.

All this governance, risk and compliance (GRC) business is pretty dry, so Lockpath aimed for a more user-friendly software than its competitors, which include Agiliance and Rsam. Caldwell says now more than ever, an entire company must understand how to avoid an audit, and putting resources on video has helped reach more employees. Most employees carry around multiple devices loaded with company email and other secure data, and as a result, he’s seen increased demand for education on internal security policies.

Even the big companies still get it wrong, Caldwell says, pointing out the hack that hit Yahoo last week. He says Lockpath’s platform would have helped Yahoo ask the right questions, for example, are all passwords hashed & salted, are all the passwords stored in one file, and what was the last patch on the database?

“Yahoo was preventable if someone had been looking,” says Caldwell. “The hackers didn’t do anything sophisticated, it’s just that someone is lazy.”

Lockpath’s series B was led by El Dorado Ventures and included participation from Vesbridge Partners and the Webb Investment Network (WIN).