Cybersecurity
Security is not buying every product. It is ranking by risk and closing the entries most likely to be breached. We assess four fronts — perimeter, endpoint, email and identity — then decide what to buy and what to do first.
Most SME incidents are not sophisticated targeted attacks. They are phishing, weak passwords, unpatched systems and excessive permissions. These four account for the large majority. So we fix those first, then discuss advanced controls.
1. Four layers, outside in
Perimeter: firewall and web control
Control inbound and outbound traffic, block risky services, separate guest and internal networks, and keep searchable logs.
Endpoint: PCs and servers
Antivirus/EDR, disk encryption, patch management and device control, so one infected machine does not become a company-wide incident.
Email: the main entry point
Filtering, attachment sandboxing, DMARC and phishing awareness — addressing the human layer.
Identity: accounts and permissions
MFA, least privilege, separate admin accounts and immediate offboarding — the cheapest and most effective layer.
2. Perimeter: firewall and web control
- Segmentation and policy: separate internal, server, guest and IoT networks; default deny, open explicitly.
- Application awareness: control by application rather than port alone, given how much traffic is now encrypted.
- Remote access: VPN or zero-trust access instead of exposing management ports to the internet.
- Logging and alerting: retain logs, alert on abnormal outbound connections and repeated failed logins.
- High availability: pair devices on critical sites so the firewall is not itself a single point of failure.
3. Endpoint protection and patching
| Item | Approach | Problem it solves |
|---|---|---|
| Antivirus / EDR | Behaviour detection with central management; blocks suspicious processes and lateral movement | Ransomware, fileless attacks |
| Patch management | Risk-tiered, scheduled updates for OS and common applications | Exploitation of known vulnerabilities |
| Disk encryption | Full-disk encryption on laptops and removable drives | Data loss from lost devices |
| Device and app control | Restrict unauthorised USB and software installation | Data exfiltration, malware introduction |
| Backup and drills | 3-2-1 principle with periodic restore tests | Recovery after ransomware |
4. Email security: the best first investment
Over ninety per cent of intrusions start with an email. Email security has three jobs: stop impersonation, stop malicious attachments and links, and help staff recognise them.
- SPF / DKIM / DMARC: start at p=none to collect reports, then tighten to quarantine or reject, so no one can send as your domain.
- Attachment and link sandboxing: detonate suspicious files and URLs in isolation before delivery.
- External sender marking: visual labels on inbound external mail reduce "fake colleague" success rates.
- Phishing simulation: periodic test mails with click-rate tracking and targeted retraining.
- Response playbook: when someone clicks, change the password, revoke sessions and check forwarding rules within 30 minutes.
5. Security assessment
The point is not a thick report. It is a risk-ranked remediation list with cost estimates. We offer three levels.
| Level | Content | Output | Suitable for |
|---|---|---|---|
| Configuration review | Firewall rules, account permissions, backup and patch status, MFA coverage | Risk list with quick fixes | Most SMEs as a starting point |
| Vulnerability scan | Known-vulnerability scanning of external services and internal hosts | Findings with remediation priority | Businesses with public-facing services or compliance needs |
| Penetration test | Authorised simulated attack to verify exploitability | Test report and remediation verification | When clients or regulators require it |
Any testing requires written authorisation with an agreed scope and time window. We do not test systems without it.
6. Managed monitoring
Security equipment nobody watches is not security. Managed services address the most common gap: alerts with no one to act on them.
- Coverage: central monitoring of firewalls, endpoints, backups and critical servers.
- Alert handling: tiered notification with initial guidance; major incidents trigger a response process.
- Reporting: monthly or quarterly summary of incidents, patch progress and risk trends.
- Integration with managed IT: if we also run your IT, alerts become tickets directly — no separate process.
7. Support hours and scope
The most common misunderstanding in security is scope: does "managed monitoring" mean somebody blocks an attack at 3am? That depends entirely on what the contract says. Below is our standard scope.
| Item | What we do | What you should know |
|---|---|---|
| Support hours | Mon-Fri 09:00-18:00 for changes, enquiries and alert follow-up; 24x7 alerting available as an add-on | Office-hours plans do not include overnight intervention |
| Response time | Security incidents acknowledged within 2 hours with an initial assessment and recommended actions | Acknowledging is not containing; containment needs your authorisation |
| Scope of work | Firewall rules, endpoint alerts, DMARC report interpretation, compromised account handling | Forensics and legal investigation are out of standard scope |
| Escalation | Suspected data breach or ransomware triggers the incident process with daily updates | Do not wipe or reinstall before calling us - it destroys the evidence |
8. FAQ
We are a small company — would anyone attack us?
Yes, and more often than you would think. Most attacks are automated scans that do not choose by size. Small firms usually have no dedicated IT, so breaches are discovered later. MFA, backup and patching are cheap and effective.
Do we need to replace our firewall?
Not necessarily. If the existing device is supported and has the required features, we tune rules and configuration first. Replacement is recommended when it is end-of-life, unsupported, or underpowered.
How often should we test?
Depends on sector and obligations. Regulated businesses typically test annually; others can start with a configuration review and vulnerability scan, and test after major changes such as new systems or relocation.
What do we do if hit by ransomware?
First isolate affected devices and network segments — do not rush to reinstall. Then verify that backups are intact and unencrypted. Only then plan recovery. Paying is not a guarantee of decryption and may invite further attacks.
Does managed monitoring mean you can see our data?
Monitoring focuses on device status, logs and alerts, not business content. Endpoint investigation is carried out with your authorisation and recorded.
Have a project in hand? Start with the requirements.
Tell us the purpose, location and timing. We will come back with what is feasible, what it depends on, and an indicative price range.