Cyber security for small business: where we'd start.

Most small businesses that get caught out aren't targeted by anyone clever. A password gets reused, an email gets clicked, an update gets put off, and there's no backup that actually restores. Each one is fixable.

1. Get Microsoft 365 set up properly

If your email and files live in Microsoft 365, that's where most of your protection is. Multi-factor sign-in for everyone, old accounts switched off when people leave, and the security features you're already paying for actually turned on. A lot of setups we look at have the licence but none of the settings.

2. Have backups that restore

Having a backup and being able to get your files back are two different things. Ask when anyone last restored a real file from it. Ask whether there's a copy that isn't sitting on the same network, in case something spreads. If nobody knows the answer, that's the first job.

3. Keep things updated

Computers, the router, the server in the cupboard. Updates are boring and easy to put off, which is why old ones are what gets exploited. This should be happening in the background without anyone in the office having to think about it.

4. Help your team spot a dodgy email

Fake invoices, "can you just pay this", a login page that looks almost right. A short, friendly chat with the team does more than any poster. And make it easy to ask: "Is this one real?" should be a normal question, not an embarrassing one.

5. Know who to call

If something does go wrong, the worst part is not knowing who to ring. Have a number, have someone who knows your setup, and don't wait to see if it goes away on its own.

None of this is glamorous. It's mostly the day-to-day IT work we already do for our customers, done carefully. If you'd like us to look at where you stand, we're happy to.