A security baseline that is documented, applied and checked.
Most breaches in small businesses come from unpatched systems, weak identity controls and email. We close those gaps first, then keep them closed.
- Response within 1 business hour
- Scales from 1 to 500+ users
- One accountable partner, from cabling to cloud
- A fixed monthly fee and no surprise invoices
Protection applied where incidents actually begin.
Perimeter security
Firewall rules, segmentation and remote-access policies configured and documented, then reviewed on a schedule rather than left untouched for years.
- Firewall rules reviewed line by line; unused rules removed, the rest documented with an owner
- Guest, staff, voice and CCTV traffic segmented
- Remote access moved to VPN or a zero-trust service; open RDP closed
A documented firewall policy and a change log.
CadenceInitial review, then quarterly
Endpoint protection
Endpoint detection and response on every workstation and server, with alerts monitored and quarantined items reviewed.
- Endpoint detection and response deployed to every workstation and server, with tamper protection on
- Alerts monitored; quarantined items reviewed and reported
- Unprotected or unreporting devices chased weekly
Endpoint coverage and alert figures in the monthly report.
CadenceContinuous monitoring
Email security
Filtering, domain authentication (SPF, DKIM and DMARC) and impersonation controls, because invoice fraud starts in the inbox.
- SPF, DKIM and DMARC configured, then DMARC moved from p=none to p=reject in stages, with reports monitored
- Filtering and impersonation protection tuned to your domain
- Suspicious messages reported by staff reviewed and acted on
A domain that is harder to spoof, and fewer phishing emails reaching staff.
CadenceInitial setup, ongoing tuning
Identity and access
Multi-factor authentication, conditional access and least-privilege permissions across Microsoft 365 or Google Workspace.
- Multi-factor authentication enforced for every user and administrator through Microsoft 365 or Google Workspace policies
- Conditional access: unmanaged devices and unusual locations challenged or blocked
- Shared-drive permissions reviewed to least privilege
An access review record and a short list of privileged accounts.
CadenceSetup, then half-yearly review
Backup and recovery
Backup with an immutable copy and tested restore procedures, so ransomware does not become a business-ending event.
- Backup with an immutable copy, so ransomware cannot encrypt the backup too
- Restore procedure written and tested
- Recovery time and recovery point targets agreed with you
A tested recovery plan on paper.
CadenceQuarterly test
Awareness training
Short, practical sessions for your team on phishing, payment fraud and password handling, repeated at intervals.
- Short sessions on phishing, payment fraud and password handling
- Simulated phishing to measure, not to embarrass
- Results shared with management as trends, not names
A trained team and a measurable click rate.
CadenceQuarterly or half-yearly
The hardening lifecycle.
Modelled on the CIS Controls, scaled to a business without a security team.
Assess
Four-module assessment under consent: internal discovery, external surface, vulnerabilities, credential exposure.
Prioritise
Findings ranked by severity and effort against the Security Baseline; immediate actions raised the same day.
Harden
MFA enforced, EDR deployed, SPF/DKIM/DMARC at p=reject, firewall rules rebuilt, least privilege applied.
Monitor
Endpoint and firewall alerts reviewed; monthly vulnerability scan; breach data re-checked quarterly.
Review
Quarterly access and configuration review; annual awareness training with a measured phishing test.
What you end up with.
- A written security baseline for your business
- Multi-factor authentication across all accounts
- Email authentication configured correctly
- Tested recovery procedure
- Trained staff who can spot a phishing attempt
- Evidence you can show clients and insurers
In the terms your insurer uses.
What each service line is called in a questionnaire or tender, and what it means in practice. Each maps to the framework table.
Endpoint detection and response
Business-grade EDR on every device, managed, with alerts reviewed by an engineer.
Managed detection and response
24/7 threat hunting and response by a specialist security operations team, escalated and managed through Nodeward. Optional add-on.
Identity and access management
Cloud identity with MFA, conditional access, separated admin accounts and least-privilege roles.
Email security
SPF, DKIM and DMARC at p=reject, with anti-phishing and attachment filtering.
Vulnerability management
Monthly scans, findings prioritised and tracked to closure in the service report.
Firewall and network security
Next-generation firewall management, network segmentation, and VPN with MFA.
Backup and disaster recovery
Business backup with immutable copies and scheduled, documented restore tests.
Security awareness training
Staff training and simulated phishing, with results reported.
Penetration testing
Scoped with an accredited partner when an insurer, regulator or client requires one.
We do not run our own 24/7 security operations centre. Round-the-clock detection is delivered through a specialist MDR partner.
Questions clients ask before signing.
Straight answers. If yours is not here, ask during the assessment.
We are small. Are we really a target?
Most attacks are automated and look for easy openings, not big names. A small firm with no multi-factor authentication is an easier target than a bank.
Is this a penetration test?
No. We run vulnerability scans and configuration reviews. For a formal penetration test, usually required by an insurer or client, we scope one with an accredited partner.
Will multi-factor authentication slow my team down?
Briefly, at setup. After that, trusted devices prompt rarely, and it stops the most common account takeover outright.
Do you help with the UAE data-protection law?
We put the technical controls in place: access control, encryption, logging and retention. Legal interpretation sits with your adviser.
What happens if we are attacked anyway?
Under a managed agreement we isolate affected systems, restore from tested backups, and work the recovery plan with you. Incident response for non-clients is quoted separately.
Request your free IT assessment.
A 60-minute review at your site. The written summary is yours to keep.