Cyber Security

We map a team member's regular activity and get told when outlier events occur, rather than waiting to be informed after something has already gone wrong.

It takes ten years to build a business and one clever hack to corrupt all its data. Buying an attack is as easy as going to the supermarket. We would rather you did not find that out first-hand.

Anti-cyber-attack technology, anti-virus and anti-malware, and data management systems that keep things secure internally. Onsite training to reduce human error is available and recommended.

The mental picture most people carry — malware slipping past anti-virus — describes a shrinking share of what actually happens to businesses.

The common version is duller and worse. Someone's password is phished or reused from a breach elsewhere, an attacker signs in as them, and everything that follows is a legitimate user doing legitimate things. No malware runs. No alarm sounds, because from the system's point of view nothing wrong is occurring. Identity is the perimeter now, and the questions that matter are who signed in, from where, on what, and whether that is normal for them.

That is why anti-virus, while necessary, answers a question that is no longer the one being asked.

Multi-factor authentication is the highest-value control most businesses can turn on, and it should have been on years ago. It is also routinely defeated now, which is worth knowing before you treat it as finished.

Attackers push repeated approval prompts until someone taps accept to make it stop. They stand in the middle of a convincing sign-in page and relay the code in real time. They steal the session token after authentication, at which point the second factor has already been satisfied.

What closes those gaps is conditional access — decisions about which devices, which locations and which risk signals are acceptable, rather than a single yes/no at the door. Phishing-resistant methods where they matter. And somebody watching for the sign-in that succeeded but should not have, which is what SIEM and monitoring is for.

Ransomware gets the attention. Business email compromise takes the money.

The pattern is consistent: an attacker sits in a mailbox reading quietly, learns how your business talks about payments, then intervenes in a real conversation at the right moment with new bank details. Nothing is encrypted. Nothing is obviously broken. The first anyone knows is a supplier asking where their money is.

It is defended in two places at once — the identity controls above, and a process rule that no change of payment details is actioned on the strength of an email, ever, however normal it looks. The second one costs nothing and is the one most businesses skip.

Every control above reduces the odds. None of them makes the number zero, and a provider who implies otherwise is selling you something.

So the other half of the work is what happens afterwards: whether you can tell what was accessed, whether you can get back to working, and who makes the decisions while everyone is upset. The evidence question depends on logs being collected before the incident, which is the whole argument for monitoring. The recovery question depends on backups that were tested. Neither can be arranged retrospectively.

Worth agreeing in advance, too: who you call at 6pm on a Friday, and what they are authorized to do without waiting for someone to wake up.

Insurance. Cyber policies now come with questionnaires that ask about specific controls — multi-factor authentication, endpoint detection, tested backups, admin account separation. Answering optimistically is a poor idea, because the answers are read again at claim time. If a renewal is coming, that form is a decent audit of where you actually stand.

Customers. Security questionnaires have moved down the supply chain, and businesses that never expected to be asked are now being asked. For defense contractors it is formalised as CMMC and NIST SP 800-171, and the same controls answer both.