Small-business cybersecurity should be layered.

Most attacks that affect businesses your size aren't targeted at all — they're automated and opportunistic. Credential-stuffing, phishing sent to thousands of addresses and scans for unpatched systems don't check your headcount first.

The practical difference is that a larger company usually has someone whose job is to catch these. That's the gap we fill.

Microsoft secures the platform. You're responsible for how it's configured — which users have MFA, who holds administrator rights, what sharing is allowed, whether audit logging is on, and what happens to data when someone leaves.

A default tenant has meaningful protection available and much of it switched off or unenforced. Most of the gaps we find in a 365 environment are configuration, not product limitations.

Yes. Cloud platforms protect against their own infrastructure failing. They don't fully protect you from a user deleting a folder, a departing employee clearing a mailbox, or an account compromise that destroys data before anyone notices.

Retention windows are also shorter than most people assume. Independent backup of your cloud data covers what the platform's own protections don't.

No, and neither can anyone else. What layered security does is reduce the number of ways an attack can succeed, limit how far it spreads when something does get through, and make sure you can recover.

We'd rather be straightforward about that than make a promise that falls apart the first time something happens.

No. Penetration testing is a specialist engagement and we don't present our assessment as one.

Our work is making sure the controls are in place, complete and maintained. If you need a formal penetration test — often for a client requirement or an insurance application — we'll point you toward a firm that does it properly and help you act on the findings.

Yes. Insurers increasingly ask specific technical questions: is MFA enforced on email and remote access, is there managed endpoint protection, are backups tested, how are privileged accounts controlled.

We can tell you accurately where you stand on those and implement what's missing. We don't advise on policy selection or coverage — that's your broker's job.

We work from a written plan: contain the affected accounts or devices, establish what was accessed, preserve what's needed for investigation, restore from backup, and close the gap that allowed it.

We'll also be honest about the limits of our role. Serious incidents can require forensic specialists, legal counsel and your insurer, and we'll say so rather than trying to handle everything ourselves.

The baseline is less than most people expect and more than most businesses have: MFA everywhere, managed and patched devices with endpoint protection, email filtering, encryption, controlled admin access, tested backups and a real offboarding process.

That set covers the large majority of what actually happens to companies your size. Beyond it, additional controls should be driven by something specific — a client requirement, a regulated data type, or a risk unique to your operation.