Cyber security
Protection you can explain to a client, an insurer and your board.
The controls that stop the attacks organisations your size actually face, kept current and documented so you can evidence them.
The realistic threat
You're unlikely to be targeted. You're very likely to be caught.
Small and mid-sized organisations are rarely singled out. They're swept up in automated attacks hunting the same weaknesses: an account without MFA, an unpatched machine, a convincing invoice email, an untested backup.
Which is good news: the same handful of controls closes most of it. The work isn't exotic — it's doing the basics thoroughly, and continuing to.
Compromised accounts
Credentials from an unrelated breach reused on your Microsoft 365. Closed by MFA, conditional access and monitoring for impossible logins.
Invoice and payment fraud
An attacker sits in a mailbox, waits for a real invoice thread, then changes the bank details. Closed by mailbox monitoring, training and payment verification.
Ransomware
Usually arriving through an unpatched endpoint or a compromised account. Survivable with hardened endpoints, separated admin rights and immutable, tested backups.
Oversharing your own data
Files shared with "anyone with the link" years ago, still open. Rarely an attack at all — and one of our most common findings.
What we put in place
Identity
MFA everywhere, conditional access, separate admin accounts, privileged access reviewed.
Devices
Protection, encryption, compliance policies, and the ability to wipe a lost laptop.
Anti-phishing and impersonation protection, SPF, DKIM and DMARC done properly.
Vulnerability management
Knowing what's unpatched, prioritising by real exposure, fixing it on a cycle.
Backup you can rely on
Separated, immutable where possible, and restore-tested so recovery time is known.
People
Short, regular training and realistic phishing simulations, reported by trend.
Cyber Essentials
Gap assessment, remediation and support through certification, including Plus.
Client questionnaires
We keep your documentation current and answer supplier assessments with you.
Incident response
A written plan naming who does what, agreed before you need it.
Winning work
Security is now part of your sales process.
Larger organisations audit everyone they buy from, and funders and regulators increasingly do the same. If you hold personal or commercially sensitive data, a security questionnaire will land on you — usually with a deadline.
Answering confidently looks like the safer choice. Going quiet for a fortnight doesn't. We treat this as something that wins work, not a compliance chore.
Incident support
What we cover when something goes wrong.
Boundaries agreed in advance. Better to know now than in the middle of an incident.
Common questions
Do we need Cyber Essentials?
You need it if a client or public-sector contract asks, and it's increasingly a condition of cyber insurance. It's also a useful forcing function: the five controls are the ones that matter most.
Will tightening security make everything slower for staff?
Badly implemented security does. Done well it's mostly invisible — conditional access only challenges unusual sign-ins. Where there's a real trade-off, we'll show you both sides and let you decide.
We've had an incident. Can you help now?
Get in touch and say so — we'll prioritise the call. Containment first, then recovery, then working out what happened. If you have cyber insurance, tell your insurer before engaging anyone, including us.
Is this enough for ISO 27001 or SOC 2?
It's a solid foundation and covers many of the technical controls, but those standards need governance, evidence and audit work beyond IT. We'll tell you honestly how far the gap is — see Compliance & readiness.
Find out where you'd fail a client audit.
The IT & Security Review includes a gap assessment against the Cyber Essentials controls, so you know what's exposed before someone else finds it.