Where do attacks on a small business actually start?
In the inbox, aimed at a person, usually asking for something that sounds routine. A vendor’s “updated banking instructions.” A login prompt that arrives at a busy hour. A push notification at 2 AM that someone approves just to make it stop. The pattern is old: the channel vouching for itself. The defenses that work are old too, verify on a second channel, and they hold up because they do not depend on anyone being clever at their worst moment.
What do you actually put in place?
Identity hardening first: multi-factor authentication that resists the tricks that beat ordinary MFA, least privilege so the right people have the right access and nobody else does, and access reviews on a schedule. Then email security that catches the trap, not just the obvious spam. Then managed detection, with alerts triaged by a person who can tell a threat from a Tuesday. Patching stays on rhythm underneath it all, after hours, with a way back.
Will all this security interrupt our work?
The goal is the opposite: security you stop noticing. Changes are staged and announced, updates land after hours, and controls are chosen to remove drama rather than add it. Where a control would genuinely slow your work, we say so and offer the nearest sane alternative instead of pretending there is no tradeoff.
Do our people need security training?
Yes, and it works best when it respects them. Most successful attacks need one person to hurry, so the training that matters is not an annual video marathon. It is short, regular, and tied to the real tricks in circulation: the payroll change request, the vendor’s new banking instructions, the login page one letter off. We run phishing simulations on purpose and in the open, and the stakes are kind by design. The person who clicks gets a ninety-second lesson, never a wall of shame, because the goal is a team with calibrated caution, not a team afraid of its inbox. New hires get the same footing in their first week, since attackers read new-job announcements too. The reflex we are building is simple: when a message asks for money, credentials, or urgency, verify it on a channel you already trusted before the message arrived.
How do we know it’s working?
Because you can see it, not because we say so. Short plain-English reviews connect what we run to what it protects. Evidence exists for each control: who has access, what got patched, what the detection caught. When a client sends your firm a security questionnaire, or an insurer sends a renewal application, the answers come from records, not memory. Quiet results, shown, beat loud promises.
What happens if something gets through?
A named lead calls you, plainly and early, and a rehearsed plan starts instead of an improvisation. Anyone who promises nothing will ever get through is selling something. What we promise instead: clear severity paths, a named lead, containment and recovery moves that were practiced before they were needed, and a written account afterward of what happened and what changed because of it.
Quick answers
Do we need all of this, or just some of it?
It depends on what you are protecting and what your insurer and clients expect. The assessment sorts that honestly; we would rather right-size the list than sell the whole menu.