Cybersecurity sized for the organisation you actually are
We find the weaknesses in your systems before someone else does, then help you fix them in a sensible order, starting with the changes that reduce the most risk for the least effort.
Practical security, not a pile of paperwork
Most security incidents in smaller organisations don’t involve anything clever. A password is reused, multi-factor authentication isn’t switched on for one account, a backup hasn’t been tested, or a supplier’s email is spoofed. These are fixable problems.
Our reviews look at how your systems are really configured, not just what the policy says. You get a clear report that ranks every finding by risk and by the effort needed to fix it, written so directors can understand it as well as the IT team.
What we cover
Security review
A hands-on look at the configuration of your systems and how they’re used.
- Microsoft 365 and Entra ID settings, including Secure Score
- Admin accounts, MFA and password policies
- Firewall rules, remote access and exposed services
Email protection
Email is still the most common way attacks start.
- SPF, DKIM and DMARC set up and monitored
- Anti-phishing and anti-spoofing settings
- Rules for external and forwarded mail
Devices and backups
Making sure a lost laptop or ransomware attack is an inconvenience, not a disaster.
- Endpoint protection such as Microsoft Defender for Business
- Patching and device encryption
- Backup coverage and restore testing
Cyber Essentials readiness
Preparing you for the UK government-backed certification.
- Gap assessment against the five technical controls
- Help fixing what’s missing
- Support through the self-assessment questionnaire
Policies and risk
The documents customers, insurers and auditors ask for, written to match how you really work.
- Information security and acceptable use policies
- Incident response plan
- Risk register and supplier questionnaires
Staff awareness
Your people are part of your defences.
- Short, plain-English awareness sessions
- Guidance on spotting phishing and payment fraud
- A clear way for staff to report something suspicious
Situations we’re often asked to help with
- A customer has sent you a security questionnaireWe’ll help you answer it accurately and fix any gaps it exposes, so the next one is easier.
- Your cyber insurer is asking about MFA, backups and patchingWe’ll check what’s actually in place and give you evidence you can rely on.
- You want Cyber Essentials to bid for a contractA readiness check tells you what needs to change before you apply.
- An email account was compromisedWe’ll help contain it, work out what was accessed, and close the gap that let it happen.
- Nobody is sure the backups would actually restoreWe’ll test a restore and tell you how long recovery would really take.
How a security review runs
- Agree the scopeWe confirm which systems, sites and accounts are included, and give you a fixed price and timescale up front.
- ReviewWe examine configuration, accounts, devices, backups and the external surface of your network, with read-only access wherever possible.
- ReportEach finding is explained in plain language and ranked by risk and effort, with a short summary for directors.
- FixWe can carry out the fixes ourselves, work alongside your IT provider, or leave the plan with your own team.
- Check againA follow-up review confirms the changes have worked and haven’t drifted back.
What you’re left with
- A written report with findings ranked by risk and effort
- A one-page summary for directors or the board
- A prioritised remediation plan
- Updated security settings, documented
- Policy documents you can share with customers and insurers
- Evidence to support Cyber Essentials or insurance renewals
Common questions
Is this a penetration test?
No. Our reviews focus on configuration, accounts and practical controls, plus external vulnerability scanning. If you need a formal penetration test, for example for a contract that requires a CREST-accredited tester, we can help you scope it and work with a specialist firm.
Do you issue Cyber Essentials certificates?
Certificates are issued by accredited certification bodies. We prepare you for assessment and help you fix what’s needed, so you can apply with confidence.
Will the review disrupt our staff?
Very little. Most of the work uses read-only admin access and doesn’t affect anyone’s day. We’ll ask for a short conversation with whoever manages your IT.
We’re a small business. Is this overkill?
Smaller organisations are targeted precisely because they tend to have fewer controls. A proportionate review is usually a modest piece of work, and the fixes that matter most are often free settings you already pay for.