Cybersecurity for small businesses

The unglamorous things that actually matter

Patching, segmentation, sensible passwords, multi-factor authentication and backups that have been tested do more for a small business than any single product. We start there, because that is where the real exposure usually is.

We would rather tell you your existing setup is mostly fine and fix two specific things than sell you a product you do not need.

Keeping systems apart

Separating clinical systems from the guest WiFi, or card payment terminals from the office network, limits how far a problem can travel. We use VLAN segmentation to put systems into groups that cannot freely reach each other.

This matters most for practices handling patient records, firms handling client files, and any business taking card payments.

Secure remote access

Staff working from home need access that does not expose the office network. We set up remote access that is encrypted, authenticated, and logged, rather than leaving a remote desktop port open to the internet.

Regulated and sensitive environments

We work with medical and dental practices where HIPAA considerations apply, law firms handling confidential client files, and municipal and law-enforcement systems. See industries we serve for how that work differs by sector.

Email is where most incidents start

The majority of small business incidents arrive by email: an invoice that looks right, a login page that looks right, a request from the owner that looks right. The technical controls that matter are multi-factor authentication, which stops a stolen password being enough, and a mail filter that catches the obvious attempts.

The rest is habit. A finance process where payment details are never changed on the strength of an email alone prevents more loss than any product we could sell you.

Who can reach what

Accounts accumulate. Staff leave and their logins stay active, contractors keep access long after a project ends, and shared passwords spread. We review who has access to what, remove what is stale, and separate administrator accounts from day-to-day ones.

This is unglamorous and it is consistently where we find the largest gaps.

What we do not claim to be

We are not a compliance auditor, a penetration-testing firm or a security operations centre. We handle the technical controls a small business actually needs and we will tell you plainly when something is outside what we do, rather than selling it badly.

Frequently asked questions