The backup nobody has restored

How we work

Boring controls, tested properly

Cyber security sold to small businesses tends to arrive as a product. The controls that actually prevent incidents are duller and cheaper: patch what you run, stop people working as administrators, turn off what nobody uses, and disable the accounts of staff who left. Cyber Essentials is essentially a checklist of that, which is why most of the work is configuration rather than purchasing.

Backups are the clearest example of a control everyone believes they have. Having a backup and having a restore are different things, and ransomware encrypts whatever it can reach — including the backup drive plugged into the server. Testing a restore in front of the client, and verifying one copy is genuinely unreachable, changes an assumption into a fact.

Phishing simulations deserve care too. Run to catch people out, they teach staff that mistakes are punished, so the next real click gets hidden for a day. Run to build reporting, they shorten the only interval that matters: the gap between the click and somebody telling you.