Security that’s proportionate to your business
There’s a security industry built on selling enterprise-grade products to businesses that don’t need them, and another built on telling SMBs they’re fine because they have antivirus. Both are wrong. What most UK SMBs actually need is a sensible, layered set of controls, most of them already paid for inside their existing Microsoft 365 licences, properly configured by someone who’s done it before.
That’s what I do. I’m not selling you a security product line. I’m taking what you’ve got, working out what genuinely protects your business and your clients, and putting it in place. The result is a security posture that holds up against the threats SMBs actually face, phishing, account compromise, ransomware delivered through a single careless click, without the compliance overhead of an enterprise programme that isn’t right for your size.
What sensible security looks like for an SMB
The biggest single uplift in security for a typical SMB is identity: MFA on every account, conditional access policies that block sign-ins from unexpected geographies and devices, and admin accounts properly separated from day-to-day accounts. That alone closes the door on the bulk of automated attacks.
Layer on Defender for Endpoint (a proper EDR rather than legacy antivirus), Defender for Office 365 (anti-phishing, safe links, safe attachments), a 3-2-1 backup that’s actually tested, and a written security baseline so you’ve got something to point at when a client asks, and you’ve got security that’s proportionate, sustainable, and meaningful.
I document everything. When the work is done, you should be able to read a clear summary of what’s been set up, what each control is for, where the residual risks sit, and what would need to change to harden things further. No mystery. No reliance on me being the only person who understands it.
When something goes wrong
Most of the security incidents I deal with for SMBs follow a pattern: someone clicks a phishing link, an account gets compromised, and the attacker either uses it for further phishing or for invoice fraud. Speed of response matters more than anything else. Account locked, sessions revoked, MFA reset, mailbox forwarding rules audited, recent activity reviewed, the first hour is where the real damage gets prevented.
If you’re an active client, that response is built into the retainer. If you’re not, get in touch immediately and I’ll help, and we’ll have a proper conversation afterwards about what put you in that position and what stops it happening again.