Practical cyber security and backup for small businesses
Most breaches at businesses of your size are not sophisticated. They are an unpatched laptop, a password reused from a personal account, or an invoice email that looked genuine. The defences that matter are unglamorous and they work.
Four ordinary layers, in the order an attack meets them. Each one is cheap on its own; together they stop the attacks that actually happen to businesses your size.
What we put in place
Endpoint protection
Anti-malware on every device that connects to your business systems, monitored centrally rather than left to each user.
Patching
Operating systems and applications updated on a schedule. Most successful attacks use a flaw that was fixed months earlier.
Multi-factor authentication
On email and on anything else that faces the internet. The single most effective step a small business can take.
Email security
Phishing and spoofing filtering, and your domain configured so that others cannot send mail as you.
Monitored backups
Backups that are checked, with restores actually tested. A backup that has never been restored is an assumption, not a backup.
A written baseline
What is protected, how, and who has access — documented, so the answer does not live in one person's head.
Your staff are not the weak link — they are the last one
Blaming people for clicking is easy and useless. Our approach is to remove as many decisions from them as possible: filter what arrives, block what should not run, and require a second factor so that a stolen password on its own is not enough. Then give short, practical guidance on the handful of judgements that remain — mainly payment requests and unexpected attachments.
Cyber Essentials readiness
Cyber Essentials is the UK government-backed scheme that larger customers and insurers increasingly ask about. The controls it requires are the ones listed above, so preparing for it is mostly a matter of documenting what is already in place and closing the gaps.
We help you get ready for certification. We are not a certifying body, and we do not claim certifications we do not hold — if a formal certificate matters for your own compliance, tell us at the first conversation and we will be straight with you about where we stand.
When something does happen
No set of defences is complete, so there needs to be a plan for the day one fails. Ours is written down before it is needed: who to call, what gets isolated first, where the clean copy of the data is, how long a restore takes, and who tells your customers. Deciding this calmly in advance is worth more than any single product.
Find out where you actually stand
Security and backup are included in our managed IT support plans. If you would rather start by seeing what state things are in, ask for an IT health check.