Cyber security
Cyber security for small businesses, built in layers
Criminals rarely pick targets. They pick weaknesses: a reused password, an unpatched laptop, a convincing invoice email. We close those gaps one layer at a time, then keep watching, so a single mistake doesn’t turn into a business-stopping incident.
- Microsoft Partner
- Cyber Essentials certified
- 5.0 on Google
- MDR includedon every managed plan
- Cyber Essentialscertified ourselves
- Trainingand phishing simulations
- 01843 482 279Speak to an engineer
Why it matters
Most attacks on small businesses aren’t clever. They just work.
The UK Government’s own research finds that a large share of businesses report a breach or attack every year, and that phishing is by far the most common way in. These aren’t Hollywood hacks. Most are emails that look like they came from a supplier, a bank or Microsoft.
The good news: the controls that stop the majority of these attacks are well understood and affordable. They just need setting up properly and keeping on.
- 43%of UK businesses reported a breach or attack in the last 12 months
- 85%of those said phishing was involved, the most common attack by far
Defence in depth
Security in layers, because no single product stops everything
Antivirus on its own hasn’t been enough for years. Attackers log in with stolen passwords, trick staff into approving payments, or wait for an unpatched app. Each layer below stops a different kind of attack, and if one fails, the next is still there.
- People: short, practical training and simulated phishing so staff spot the fake before they click.
- Identity: MFA and conditional access, so a stolen password alone doesn’t open the door.
- Email: filtering for phishing, impersonation and malicious attachments before they reach the inbox.
- Devices: managed updates, encryption and endpoint protection with 24/7 detection and response.
- Network: properly configured firewalls, segmented Wi-Fi and secure remote access.
Cyber security services
Every layer, available on its own or as a package
Most clients get the essentials through a managed IT plan. Each service below can also be delivered on its own if you already have IT support.
- Cyber Essentials Get certified with the government-backed scheme, with our help preparing every control.
- Endpoint Protection Managed detection and response on every device, watched around the clock.
- Email Security Stop phishing, impersonation and invoice fraud before it lands.
- MFA Two-step sign-in rolled out without locking anybody out.
- Cloud & Network Security Firewalls, Microsoft 365 hardening and secure remote access.
- Compliance & Frameworks GDPR, DSPT, ISO 27001 readiness and supplier questionnaires.
- Cyber Security Training Bite-sized training and simulated phishing for your team.
Real-world threats
How small businesses actually get breached, and what stops it
These are the incidents we see and hear about most in Kent. Every one of them is preventable.
-
Invoice and payment fraud
A criminal gets into a supplier’s mailbox, or fakes one, and sends “updated bank details”.
- Impersonation filtering
- MFA on every mailbox
- A call-back rule for bank changes
-
Stolen passwords
A password reused on a breached website is tried against your Microsoft 365 account.
- MFA and conditional access
- A managed password manager
- Alerts on risky sign-ins
-
Ransomware
Files are encrypted and a ransom demanded, often after attackers have been inside for days.
- MDR that spots and isolates threats
- Patched devices and apps
- Tested, offsite backups
-
Lost or stolen laptops
A laptop left on a train holds client files, saved passwords and email.
- Full-disk encryption
- Remote wipe
- Data in the cloud, not on the device
-
An honest mistake
Someone shares the wrong folder, or clicks a link on a busy afternoon.
- Short, regular training
- Sensible sharing settings
- Permissions that fit each role
-
An open network
Guest Wi-Fi on the same network as the server, or a default router password.
- Segmented guest Wi-Fi
- Managed firewall rules
- Firmware kept up to date
If something gets through
A plan for the bad day, agreed before it happens
No security is perfect, so we plan for the worst as well. If an account is compromised or malware is detected, the affected device or user is isolated, the threat is contained and investigated, and you get a plain-English account of what happened and what we changed.
We’ll also help you with the parts that aren’t technical: who to tell, whether to report it to the ICO, and what to say to clients.
Incident: suspicious sign-in
Example timeline
- Sign-in from an unusual location Detected
- Account blocked, sessions revoked Done
- Mailbox rules & activity checked Done
- Password reset, MFA re-registered Done
- Report sent to the director Sent
FAQ
Cyber security questions from Kent businesses
Can’t see your question? Call 01843 482 279 or email hello@squareoneit.co.uk. You’ll get a straight answer from an engineer.
Is my business too small to be a target?
No. Most attacks aren’t targeted at all. Criminals send huge volumes of phishing emails and try stolen passwords against thousands of accounts, and small businesses are often the easiest wins because they have the fewest controls in place.
What’s the single most effective thing we can do?
Turn on multi-factor authentication for email and every cloud service. It stops the large majority of account takeover attempts. After that: keep devices updated, use endpoint protection with detection and response, and make sure backups are tested.
Do we need Cyber Essentials?
If you bid for government contracts that handle personal data, you’ll need it. Many larger clients and insurers also ask for it. Even when it isn’t required, it’s a sensible baseline and a clear way to show customers you take security seriously.
Is cyber security included in your managed IT plans?
Yes. Every plan includes endpoint protection with MDR, managed updates and Microsoft 365 management. Business adds email security, device encryption and Microsoft 365 backup, and Complete adds security awareness training, simulated phishing, a managed password manager and an endpoint firewall.
Can you help if we’ve already been hacked?
Yes. Call us straight away on 01843 482 279. We’ll help contain the incident, secure affected accounts and devices, work out what happened and get you back up and running, then put controls in place to stop it happening again.
Do you work with our existing IT provider?
We can. Services such as Cyber Essentials preparation, training and email security can be delivered alongside an existing provider or in-house IT person.
Find your gaps before someone else does
Our free security review looks at sign-ins, email, devices, backups and your network, then ranks what to fix by risk. You keep the report either way.
- Free, no obligation
- Ranked by risk
- Plain English
- Call the team01843 482 279
- Emailhello@squareoneit.co.uk
- VisitKent Innovation Centre, Thanet Reach Business Park, Broadstairs CT10 2QQ
- Helpdesk hoursMonday to Friday, 9am – 5pm