Services / Cybersecurity
Security that fits a small organization, without the fear-selling.
Most breaches at small companies come down to the same handful of gaps: no MFA, old software, one shared password, email anyone can spoof, and backups nobody tested. We close those first, prove it, then talk about the rest.
Who this is for
Organizations that handle customer data, take payments, hold contracts with security clauses, or simply can't afford a week offline — and don't have a security person. Also firms that need to show a client, an insurer or an assessor that the basics are done and documented.
Deliverables are prioritized: cheap fixes that remove most of the risk first, then a costed plan for the rest. No 80-page report of red boxes.
What's included
- Security baseline review across identity, devices, network, email and backups
- MFA rollout on email, VPN, remote access and every admin account
- Password manager with shared vaults and offboarding workflow
- Email authentication: SPF, DKIM, DMARC to enforcement, plus phishing-resistant settings
- Managed endpoint detection and response
- Firewall policy review, segmentation, replacement of end-of-life gear
- Patch and vulnerability management with monthly remediation tracking
- Log collection and SIEM monitoring with alerts that mean something
- Security awareness training and phishing simulation
- Incident response: containment, eradication, recovery, and a frank post-mortem
- Compliance programmes: CMMC Level 1–2, HIPAA Security Rule, cyber-insurance questionnaires
- Written policies people can actually follow, and an incident response plan tested yearly
How an engagement runs
- Baseline
A few hours looking at how things actually are, with your help. You get a short, ranked list.
- Quick wins
MFA, patching, password manager, email authentication. Usually a week; most of the risk gone.
- Structural fixes
Segmentation, EDR, logging, backups, policies — quoted separately so you set the pace.
- Keep it there
Monthly monitoring and quarterly reviews so the posture doesn't drift back.
Common questions
Do we really need this at our size?
Attackers automate; they don't check headcount. Small organizations are hit precisely because the basics are missing, and the basics are not expensive.
Will this disrupt staff?
MFA and a password manager take an afternoon and some patience. Everything else is scheduled around you.
Can you handle an incident happening right now?
Yes. Email with 'incident' in the subject or use the support page. Containment first, paperwork after.
Do you do penetration testing?
Scoped external and internal testing for small environments, yes. Where a formal third-party report is required we'll help you prepare and refer you.
Tell us what's broken, or what you want built.
Describe it in a sentence or two. You'll get a straight answer about whether we can help, usually the same business day.