Cyber security for businesses without a security department.
Practical protection for companies that run on e-mail, cloud applications and a few servers: the controls that stop most attacks, an assessment that shows where you stand, and a plan you can act on — without an enterprise budget.
Our security work addresses those realities first, then builds outwards. Every measure is chosen for its effect on risk, not for its place in a product catalogue.
Security assessment
- Inventory of systems, accounts, data and who has access to what
- External scan: what is visible on the internet, which services are exposed
- Configuration review of Microsoft 365 or Google Workspace, cloud accounts and firewalls
- Backup and recovery check: does a restore actually work?
- A written report with findings ranked by risk and a fix list with effort estimates
Identity and access protection
- Multi-factor authentication for all users and all administrators
- Conditional access, session limits, blocking of legacy protocols
- Privileged accounts separated from daily accounts
- A password manager and a workable password policy
- Offboarding that actually removes access
E-mail and endpoint protection
- Anti-phishing, attachment and link filtering, spoofing protection with SPF, DKIM and DMARC enforcement
- Endpoint detection and response (EDR) on laptops and servers
- Device encryption, automatic updates, application control
- Web filtering where appropriate
Server, cloud and web application security
- Hardening baselines, patch management, reduction of exposed services
- Web application firewall, rate limiting, bot protection
- Vulnerability scanning on a schedule, with fixes tracked to closure
- Cloud security posture: public storage, open security groups, unused keys
- Logging and audit trails kept for investigations
People, policies and readiness
- Short, practical security awareness sessions and phishing simulations
- Acceptable-use, access and incident policies written for your size
- An incident response plan: who does what, whom to call, how to communicate
- Support for GDPR technical measures and for questionnaires from customers, banks and insurers
Containment
Affected devices are isolated, credentials reset, attacker access blocked, and evidence preserved.
Investigation
What was reached, since when, through which route, and which data may be affected.
Recovery
Clean rebuild of affected systems, restore from verified backups, verification before anything is reconnected.
Reporting
Documentation for management and insurers and, where personal data is affected, support for the notification to the data-protection authority within the 72-hour GDPR window.
Clients with a security retainer have priority. Other companies are helped as capacity allows — call rather than write.
Assessment weeks 1–3
Inventory, external scan, configuration review, backup check. A ranked report and a fix list.
Quick wins weeks 3–6
MFA everywhere, e-mail protection, patching, verified backups, removal of unused accounts and exposed services.
Programme months 2–6
The remaining fix list: EDR, device policies, segmentation, logging, policies and training.
Ongoing monthly
Monitoring, patching, vulnerability scans, access reviews, and a re-assessment every year.
- Identity policies maintained: MFA, conditional access, privileged accounts.
- Endpoint protection licences, deployment and alert handling.
- E-mail security monitoring, DMARC reports, phishing handling.
- Vulnerability scan every month, with fixes tracked.
- Access review every quarter.
- Awareness session twice a year, plus phishing simulations.
- Incident support with priority handling.
- Report every month: alerts, incidents, patch status, open findings.
Do we need this if we are a small company?
Attacks on small companies are automated and indiscriminate; a phishing e-mail does not check your headcount. A small set of controls — MFA, patching, tested backups, e-mail filtering — prevents the large majority of incidents, and they are affordable at any size.
Is this a 24/7 security operations centre?
No. We provide the controls, monitoring with alerting and business-hours response for small and medium-sized companies. Where a client needs 24/7 managed detection and response, we integrate a specialised provider and remain your single contact.
Will you help with NIS2 or ISO 27001?
We implement the technical and organisational measures and prepare the documentation. For formal certification you engage an accredited auditor; we prepare you for it. Whether NIS2 obligations apply to your company depends on sector and size — we help you find out.
Can you help with a cyber-insurance questionnaire?
Yes. The questions — MFA, backups, EDR, patching, training — map directly onto the controls we implement; we complete the technical parts with you and provide the evidence.
Backup and disaster recovery
Backups of cloud applications, servers and devices; recovery plans; restore tests you get a report on.
Read more →ServicesManaged IT and workplace
Service desk, Microsoft 365 / Google Workspace, identities, devices and licences — run for you.
Read more →ServicesCloud management
Architecture, migration and operation on AWS, Microsoft Azure, Google Cloud and European providers, in EU regions.
Read more →Start with the assessment.
Two to three weeks, a fixed fee, and a written picture of where you stand. We reply within one business day.