Cybersecurity services that fit the way your team works

Cybersecurity for a small or midsize company is mostly about everyday decisions: who can sign in to what, which devices hold company data, whether a lost laptop is a minor nuisance or a serious incident, and whether anyone knows what to do when something looks wrong. Our cybersecurity service helps you look at those questions in a structured way and agree which improvements matter first. It is aimed at organisations with people in Europe, and conversations take place in English or Spanish.

Why cybersecurity looks different in a distributed business

When a team is spread across several countries, the traditional office perimeter largely disappears. People work from home, from client sites and from shared spaces; they use personal phones alongside company laptops; and they exchange files with suppliers and customers who have their own standards. Each of these habits is understandable, yet together they widen the number of places where an account, a device or a document can be exposed.

Regulation also varies. Data-protection rules in the UK and in EU countries share many principles but differ in details, and some customers will ask for evidence of security practices in a contract or a questionnaire. We do not give legal advice or certify compliance, but the findings of the review can help you describe what is actually in place, so that the right people can answer those questions more accurately. If the customer is covered by NIS2, our guide to NIS2 supplier requirements shows what such customers typically ask suppliers for.

What’s included in our cybersecurity service

Identities and access

Accounts are the most common way in. We review how users sign in, whether multi-factor authentication is used consistently, who has administrative rights, how leavers and new starters are handled, and how shared accounts and passwords are managed. Small improvements here usually have an outsized effect.

Devices and endpoints

We look at laptops, phones and tablets used for work: whether they are inventoried, how updates are applied, whether disks are encrypted, what happens when a device is lost, and which protection tools are installed and who looks at them. For companies using Microsoft 365, many of these controls can be managed centrally, and we point out where that is possible. For a checklist of settings to review, see our baseline security settings for Microsoft 365.

Email, network and cloud services

Email remains a frequent route for phishing and fraud, so we review filtering, sender protection and how suspicious messages are reported. We also look at office networks, remote access, Wi-Fi arrangements and the way cloud services are configured and shared outside the company. For the email part, see our guide to email authentication records (SPF, DKIM, DMARC).

Backup and recovery

A backup that has never been restored is an assumption, not a safeguard. We examine what is backed up, where copies are stored, who can delete them and whether recovery has been tried for the systems your business cannot do without. The concepts behind this review are explained in our backup and recovery guide.

Incident preparation and awareness

Depending on the case, this can include helping you write down, in plain language, who decides what when something goes wrong, who must be informed and which systems are restored first. It can also include a discussion of short, practical awareness sessions for staff, focused on the scams and mistakes most relevant to your type of work.

Who cybersecurity support is for

This service suits organisations that handle customer, employee or financial information and have no dedicated security team. Typical starting points include:

• A company that has grown quickly and wants to check that basic protections keep pace.
• A business whose customers or partners have started asking security questions it cannot easily answer.
• A team that has experienced a phishing attempt or lost device and wants to be better prepared.
• An organisation moving to remote or hybrid work across several countries.
• A manager who needs priorities and costs explained clearly before approving security spending.

How we work

1. Scoping conversation. We agree which teams, systems and locations are covered and what you most want to understand or improve.
2. Review. We examine accounts, devices, backups, network and cloud settings together with the people who manage them, and record what we find in clear terms.
3. Prioritisation. Findings are grouped by likely impact and effort, so you can see which changes are quick wins and which need planning or budget.
4. Plan and responsibilities. Depending on the case, this can include agreeing a sequence of improvements, who owns each one and how progress will be reviewed.
5. Ongoing support. If you want day-to-day help with updates, monitoring or user support, it can be combined with managed IT services, with scope agreed separately.

We do not promise a risk-free organisation, because that does not exist. What we aim for is a clear picture, sensible priorities and, depending on the case, agreed responsibilities, expressed in language non-specialists can follow. To see how an audit, a vulnerability scan and a penetration test differ, read our security audit guide. Support is provided in English and Spanish, and working arrangements for your organisation are agreed in advance.

How the security baseline is built

The review is built around a guided review with your team: we go through the systems together with the people who administer them, and we write down what we find. Three concrete checks sit alongside it: a control list for your Microsoft 365 tenant, an inventory of devices and a restore test. Each is described below, with the reasoning behind it.

Guided review with the people who run your systems

We review alongside whoever administers each system because they know the exceptions that no export shows: the temporary account that became permanent, the shared mailbox nobody looks after, the backup job that was paused during a move. Going through the systems together also means findings can be explained and checked on the spot instead of arriving as a surprise in a report.

The Microsoft 365 control list

For organisations using Microsoft 365, we read the tenant configuration against our own control list, concentrating on three areas. See an excerpt of a sample control list (illustrative example).

• Multi-factor authentication. Whether it is applied consistently, including to administrators and to accounts used by several people or by services, because the exceptions are where a sign-in attack is most likely to succeed.
• Administrators. Who holds administrative roles, whether those are separate named accounts, and whether anyone kept rights after changing role. Fewer, clearly justified administrators means fewer accounts whose compromise would matter most.
• Mail rules. Automatic forwarding and hidden inbox rules, which are a common trace of a compromised mailbox and of invoice fraud because they let someone read or divert messages without the mailbox user noticing.

Device inventory

We build a list of the laptops, phones and tablets used for work, typically noting encryption, update and protection status for each. The inventory comes first because a device nobody knows about cannot be updated, protected or wiped when it is lost.

Restore test

We restore a sample item from a critical system to check that the backup really works. A sample is enough to test the whole chain: that a copy exists, that someone can reach it, that it can be read and that the person doing the restore knows the steps. Two pitfalls are worth knowing: a backup job that reports success while producing nothing usable, and copies kept where the same administrator account that runs the live system can also delete them. Our disaster recovery plan guide explains how recovery planning fits together.

What you receive: findings grouped by impact and effort

At the end of the review you receive the findings in plain language, grouped by impact and effort: improvements that are quick to make, and improvements that need planning or budget. The report is written so that a manager who is not a specialist can follow what was found, why it matters and what kind of change it calls for.

Why impact and effort together

Grouping by impact alone produces a long list that nobody finishes; grouping by effort alone produces busywork. Putting the two together separates situations that need different decisions. Changes with high impact and little effort are normally done first, because they are settings rather than projects. Changes with high impact and more effort go into planning and, where needed, budget. Changes with little impact and large effort can wait, and it is acceptable to say so openly.

How to read the report

Start with the quick group and ask who on your team can make each change. Then read the planning group as a set of decisions for your management rather than as a task list. Remember what the report is not: it describes what we found and how we rank it, and it is not a certificate of anything.

An illustrative example, not a real client: imagine the control list shows that multi-factor authentication covers most people but not a shared account, and that a former administrator still holds rights. Removing the old rights and enforcing authentication on the shared account are settings changes and would sit in the quick group. Replacing the shared account with named accounts means agreeing with the teams that use it, so it would sit in the planning group. See a sample findings grid (illustrative example).

Tool categories used to run security day to day

The tools involved fall into five categories. We describe categories rather than products, because what matters to your organisation is what each category does, which ones you already have and where the gaps are. Which of them apply depends on your organisation and on what is agreed.

• Remote monitoring and management (RMM) tool. Patch management, device inventory, alerts and similar routine administration, so that updates and the device list do not depend on someone remembering.
• Central device management. Encryption, update and remote wipe policies applied from a device management console, so that a lost laptop is handled by a policy instead of by hope.
• Standard endpoint protection. Anti-malware protection on work devices. It is not a managed detection and response service.
• Email protection. Filtering of unwanted and malicious messages and protection of your sender identity.
• Password manager and MFA. A password manager and multi-factor authentication applied consistently to all users, because a control used by only some people protects only some accounts.

Scope and limits of the security review

The review does not certify anything and does not provide legal advice. We do not certify compliance with NIS2, ISO or data-protection rules, and we do not give legal opinions. For general background, our NIS2 first-steps guide for SMEs offers information only.

It is also a structured look at how your basics are set up, so it does not replace specialist services. We do not run a security operations centre, we do not offer MDR and we do not carry out penetration tests. If you need those, a specialist provider is the right route, and the question to put to them is exactly what is monitored and who responds.

To discuss your situation, contact us and tell us briefly about your teams, locations and main concerns.