Cyber Security for Small and Mid-Sized Businesses

Small businesses are the target, not the exception

There is a persistent belief among smaller businesses that they are too small to be worth attacking. It was never true and it is comprehensively untrue now. Most attacks are not chosen — they are automated, scanning everything, taking whatever gives way first. A fifteen-person accountancy practice with an unpatched firewall is an easier target than a bank, and the criminals know it.

The other half of it is that you are a route to somebody else. If you supply a larger organisation, you are part of their attack surface, and increasingly they will ask you to prove you are not the weak link.

What we put in place

Managed endpoint detection and response (EDR)Beyond traditional antivirus. EDR watches behaviour rather than matching known signatures, so it catches things that have never been seen before — and it is monitored, so somebody acts when it fires.

Email filtering and phishing protectionEmail is still how most attacks arrive. Filtering stops the bulk of it before anyone sees it, and impersonation protection catches the "urgent request from the MD" messages that get through conventional spam filters.

Multi-factor authentication and conditional accessThe single highest-value control there is. MFA on everything, with conditional access rules so a login from an unexpected country at 3am is treated differently from one at the office.

Phishing simulation and staff trainingShort, regular, non-patronising. The aim is people who pause before clicking, not people who feel caught out. We report on trends rather than naming individuals.

Patching and vulnerability managementMost successful attacks exploit something that was fixed months ago. Consistent patching is unglamorous and it does more for your security than almost anything you could buy.

Backup you can actually restore fromThe last line when everything else fails. Covered properly on our backup and disaster recovery page.

Layers, because nothing is one thing

There is no product you can buy that makes you secure. Anyone selling you one is selling you a feeling. What works is layers, so that any single failure is caught by the next thing along.

A phishing email gets past the filter. The staff member has been trained and does not click. If they do click, MFA blocks the login. If the attacker gets in anyway, EDR spots the unusual behaviour. If something encrypts files, the backup is offline and tested. Each layer is imperfect. Together they are good enough that an automated attack moves on to somebody easier.

Where we start. Usually with MFA, patching and backup, in that order — because they are cheap, unexciting and prevent more real-world incidents than anything else. We would rather fix those than sell you something with a better dashboard.

When something does happen

No honest provider tells you that you will never have an incident. What matters is what happens next: whether anyone notices, how fast it is contained, and whether you can get back to trading.

Monitored EDR means detection is not waiting for somebody to mention their laptop feels slow. Documented response means we know which machine to isolate without a conversation about it first. Tested backups mean recovery is a measured job rather than a discovery exercise. And if reporting to the ICO is required, we help you do that properly and within the deadline.

Proving it to your clients

Increasingly, security is something you have to demonstrate rather than simply have. Tenders ask. Insurers ask. Larger customers send questionnaires.

Cyber Essentials is the standard most UK buyers recognise, and it is mandatory for many public-sector contracts. We take clients through it and keep them there. We also complete the technical sections of client security questionnaires directly — send them to us rather than having your bid team guess at the answers.

Cyber insurance

Insurers have tightened up considerably. Policies now routinely require MFA, EDR, tested backups and a patching regime — and a claim can be refused if the controls you declared were not actually in place. We make sure what you tell your insurer is true, which is worth more than the premium saving.

Not sure whether this is what you need? Book a free IT review. A real engineer looks at what you have, tells you honestly what is fine and what is not, and gives you a number. No obligation, and no sales script.

Common questions

We are a small business. Are we really a target?

Yes. Most attacks are automated and indiscriminate — they scan everything and take whatever gives way first. Smaller organisations are often easier targets because they have fewer controls, and they can also be a route into a larger customer.

Is antivirus not enough any more?

Not on its own. Traditional antivirus matches known threats. Modern attacks are frequently new, or use legitimate tools in illegitimate ways. EDR watches for unusual behaviour instead, and it is monitored so somebody responds when it triggers.

What is the single most valuable thing we could do?

Multi-factor authentication on everything, followed by consistent patching and tested backups. They are inexpensive and unglamorous, and they prevent more real incidents than any product you could buy.

Can you help us answer a client security questionnaire?

Yes. Send it to us and we complete the technical sections accurately, so your bid team is not guessing. It is included for managed support clients.

Will our cyber insurance cover us?

Only if the controls you declared are genuinely in place — insurers do check at claim time. We make sure your declaration matches reality, which matters considerably more than shaving the premium.