Most small business compromises do not involve anything clever. They involve an account with no second factor, a leaver whose access was never removed, or a laptop nobody can lock remotely.
Security work for a business this size is mostly identity: who has an account, what that account can reach, how they prove it is them, and what happens the day they leave. Devices come next, because an account is only as protected as the laptop or phone it is signed in on.
It applies wherever your systems live. Microsoft 365, Google Workspace, Windows, Apple, or the mixed set most businesses end up with. The tools have different names in each. The questions are identical.
The incidents small businesses get hit by are boring, repetitive, and largely preventable.
Somebody reuses a password, that password turns up in an unrelated breach, and a stranger signs in successfully. Multi-factor authentication is the control that makes a stolen password worthless on its own, it is included in what you already pay for, and it is skipped more often than any other setting.
The laptop came back. The accounts did not. Months later nobody can say for certain what a former employee can still reach, and the answer is often the email, the file storage and the shared logins.
Access gets granted in a hurry and never reviewed, so over a few years everybody accumulates everything. It is not malice, it is drift, and it means one compromised account is a compromise of the whole business rather than one person's mailbox.
One of the first things an intruder does in a business mailbox is create a quiet forwarding or delete rule, then wait for an invoice conversation. This is how a payment gets redirected, and the account owner sees nothing unusual because the messages are being moved before they read them.
A laptop set up out of the box, holding company mail and files, with no encryption anyone verified and no way to wipe it if it goes missing. It works fine right up until it is left somewhere.
None of this is exotic. It is the short list that stops the incidents that actually happen to businesses your size.
Accounts, administrators, shared logins, devices, and anything still active that belongs to somebody who left. For most businesses this is the first full picture they have had.
Multi-factor authentication, live access for leavers, and administrator accounts that belong to a person rather than the business. These are done before anything is tidied or optimised.
Agree the standard for accounts, sign-in and devices, then apply it consistently instead of settling it case by case at the moment somebody is waiting.
Enrol the laptops and phones that hold business data, so they can be configured, verified and wiped if one is lost. New devices then arrive already set up.
The record of who holds what and where recovery details live, kept as part of technical cleanup and reviewed rather than written once.
Usually it starts with one specific worry, then turns into a tidy-up of everything around it, because the accounts, the devices and the mail are the same problem seen from three sides.
No, and the difference matters when you are deciding what to spend on. Website security protects the site your customers visit: certificates, hardening, the common attacks against a public page.
This is about the accounts your staff log into and the devices they log in from. A business can have a perfectly secure website and still lose control of its email tomorrow, because those are two separate systems with two separate front doors.
Almost nothing that reaches a small business is targeted. That is the point. The common compromises are automated and indiscriminate: a password that appeared in somebody else's breach, a convincing sign-in page, a mailbox rule quietly forwarding invoices to an address nobody looks at.
None of that requires anyone to have chosen you. It requires an account without multi-factor authentication, which is free to turn on and is the single highest-value hour anyone can spend here.
It should not, and if a control is making normal work painful it is usually the wrong control rather than a necessary cost. Sign-in prompts that fire on every action, for instance, train people to click through them, which is worse than not having them.
The aim is that the people who work at your business barely notice, and that the change is felt by whoever tries to get in without belonging there.
No. The same questions apply wherever your accounts live: who has an account, what can they reach, is multi-factor authentication on, and what happens on the day someone leaves. We work across Microsoft 365, Google Workspace, Windows, Apple and the mixed environments most businesses actually run.
The tooling differs. The controls do not.
That is account lifecycle management, and it is where most small businesses are quietly exposed. Access should be removed the day someone goes, their mailbox converted rather than deleted so customer mail keeps arriving, their sessions ended, and any device they held either returned or wiped remotely.
Done as a routine it takes minutes. Done six months later, after a dispute, it is a scramble in which nobody is certain what that person could still reach.
No. We are not auditors and we hold no certifications, so anything we produced would carry no weight and we would rather say that than sell it. If you need a formal audit, or a framework like SOC 2 or HIPAA signed off, you need a specialist firm and we will tell you so.
What we do is the practical work underneath: the accounts, the access, the devices and the settings that a real assessment would look at first anyway.
Licences, accounts, security settings and the day to day of running a tenant.
Business email, files and calendars on your own domain.
Untangle the accounts, domains and logins nobody has a full list of.
Straight advice on the systems your business runs on.
Authentication, reputation, and the fixes that actually move the needle.
The settings worth getting right when you set up or inherit a tenant.
Most owners are not, and finding out is quick. Tell us where your accounts live and we will tell you what is exposed and what to do first.