The question is not whether you will ever be a target, but what shape your business is in the day after.
Why an SME is a target
Attackers rarely pick a business. They send thousands of phishing e-mails, search the internet for outdated firewalls and try leaked passwords on every mailbox they find. Whoever opens up most easily is next. An SME is attractive for exactly that reason: there is money, there is customer data, and there is rarely anyone watching.
The consequences are concrete: a business brought to a halt by ransomware, a hijacked mailbox sending fake invoices to your customers, or a data breach you have to report. Good security does not make you invulnerable. It does make you a hard target, and it gets you running again quickly after an incident.
What we actually do
Zero Trust: nobody gets blind trust
Traditional security trusts everything inside the network. Zero Trust does not: every user, every device and every connection is checked separately, every time. A stolen laptop or a leaked password then no longer gives free passage. With our partner Jimber we apply that principle to access from outside and to the devices on your network.
Multi-factor authentication and strong passwords
A password alone is no longer enough. We switch on multi-factor authentication for mail, cloud and remote access. Your people get a password manager, Keeper, so every account has its own strong password without anyone having to remember them.
Protection on every device
Free antivirus recognises what was known yesterday. Business protection such as Bitdefender looks at behaviour: a program that suddenly starts encrypting files is stopped and the device is isolated. We get the alert and step in, even when the laptop is at home.
E-mail security
Most attacks start with an e-mail. We filter phishing and harmful attachments before they reach the inbox. We also set up the technical records of your domain correctly, SPF, DKIM and DMARC, so nobody can simply send e-mails that appear to come from you.
Backups that are actually tested
Making copies is not the same as being able to restore. We follow the 3-2-1 rule: three copies, on two types of storage, one of them outside your office and out of reach of ransomware. And we test restoring on a fixed schedule, so we know for certain that it works on the day it has to.
Updates that do not pile up
Most break-ins use vulnerabilities for which the update has existed for months. We keep track of updates for Windows, software, firewalls and network equipment, and schedule them outside working hours.
Making your people resilient
With Phished, your staff regularly receive a simulated phishing e-mail, with a short explanation if they fall for it. Not a dull annual training, but a habit. The most important lesson: who to warn when something goes wrong, without feeling embarrassed.
What stops what
| Threat | What stops it |
|---|---|
| Phishing e-mail with a fake login page | Mail filter, multi-factor authentication, training |
| Leaked or guessed password | Multi-factor authentication, password manager |
| Ransomware | Protection on every device, updates, a backup out of reach |
| Stolen or lost laptop | Encryption, remote wipe, Zero Trust |
| Fake invoice sent from your domain | SPF, DKIM and DMARC, multi-factor authentication |
| A former employee who still has access | Individual accounts, closed on the day they leave |
No single measure is enough on its own. Security works in layers: if one fails, the next one holds.
Where we start
- Security scan: we map what is in place, where the gaps are and what the biggest risk is.
- Quick wins: multi-factor authentication, a backup out of reach and overdue updates. That closes most of the risk within a few weeks.
- A lasting baseline: protection on every device, e-mail security and a fixed rhythm for updates and restore tests.
- Follow-up: we keep watch, act on alerts and adjust as your business changes.
What the law expects
GDPR requires every business to secure personal data appropriately. NIS2 imposes stricter rules on certain sectors, and through the supply chain those reach their suppliers too. What that means for you in practice, you can read in GDPR and NIS2 in plain language.
Frequently asked questions
Surely we are too small to be of interest?
Attacks are largely automated. Targets are not chosen by size, but by how easily they open up. Small businesses are hit often precisely because they are less well protected.
What does an incident cost?
Usually more than the security that would have prevented it. On top of the recovery itself come downtime, missed invoicing, a possible report to the Data Protection Authority and your customers’ trust. A business without a usable backup can be unable to work for days or even weeks.
Do we need cyber insurance?
It can make sense, but insurers increasingly set conditions: multi-factor authentication, backups out of reach, protection on every device. A good baseline is therefore also a condition for being insured.
What do we do if it goes wrong anyway?
Disconnect the affected device from the network, but do not switch it off and do not delete anything: that can destroy traces. Call us straight away. We help with recovery, the investigation and, where needed, the report within 72 hours.
Partners for this service
Know where you stand
A security scan maps what is in order and where the biggest risks are. Would you rather get an idea yourself first? The IT check does that in ten questions.