Most breaches we are called into didn’t beat the defences. They walked through a gap: a stale admin account, an unpatched firewall, a reused password. We close those gaps and watch the ones that can’t be closed.
Smaller businesses are not too small to be a target. They are the easiest one.
Attacks are automated. Nobody picks your company off a list. A scanner finds an exposed service or a leaked password, and the rest happens without a human involved until the ransom note or the fake invoice.
The good news is that the same automation means most attacks are stopped by the basics, done consistently : multi-factor sign-in everywhere, updates applied quickly, email filtered properly, staff who can spot a fake, and someone watching for the moment something gets through.
Seven layers, because any one of them can fail.
No single product stops everything. What works is overlapping controls, so a miss at one layer is caught at the , and someone watching all of them at once.
Email security Advanced filtering on top of Microsoft’s own, catching phishing, impersonation of your directors, malicious links and lookalike senders before they reach anyone. Filtering
Advanced filtering on top of Microsoft’s own, catching phishing, impersonation of your directors, malicious links and lookalike senders before they reach anyone.
Identity and access Multi-factor sign-in on every account, conditional access, legacy sign-in blocked, and admin accounts separated from everyday ones. Applied as a standard across every tenant we look after. Enforced
Multi-factor sign-in on every account, conditional access, legacy sign-in blocked, and admin accounts separated from everyday ones. Applied as a standard across every tenant we look after.
Endpoint protection Business-grade protection with behavioural detection on every laptop, desktop and server, managed centrally and reported on. Protected
Business-grade protection with behavioural detection on every laptop, desktop and server, managed centrally and reported on.
24/7 detection and response A security operations centre watching endpoints and Microsoft 365 around the clock. Suspicious activity is investigated by a person, and a compromised device can be isolated within minutes. Watching
24/7 detection and response
A security operations centre watching endpoints and Microsoft 365 around the clock. Suspicious activity is investigated by a person, and a compromised device can be isolated within minutes.
Vulnerability management Continuous scanning, with high-risk findings fixed within 14 days and the evidence kept for auditors and insurers. Scanning
Vulnerability management
Continuous scanning, with high-risk findings fixed within 14 days and the evidence kept for auditors and insurers.
Privileged access Nobody works as an administrator day to day. Elevation is requested, approved and logged, which stops most malware installing at all. Controlled
Nobody works as an administrator day to day. Elevation is requested, approved and logged, which stops most malware installing at all.
Your people Short regular training and realistic phishing simulations, so the person who spots the fake invoice becomes the control that works when others don’t. Ongoing
Short regular training and realistic phishing simulations, so the person who spots the fake invoice becomes the control that works when others don’t.
Security tools are only worth what someone does with their alerts. Every item below is configured, monitored and acted on by us.
24/7 managed detection and response Human analysts watching overnight and at weekends, with the authority to contain a threat immediately.
24/7 managed detection and response
Human analysts watching overnight and at weekends, with the authority to contain a threat immediately.
Managed endpoint protection Deployed and policy-managed across every device, including remote workers.
Managed endpoint protection
Deployed and policy-managed across every device, including remote workers.
Email security and domain protection Advanced filtering plus SPF, DKIM and DMARC set up properly, so nobody can send convincing mail as you.
Email security and domain protection
Advanced filtering plus SPF, DKIM and DMARC set up properly, so nobody can send convincing mail as you.
Phishing simulation and training Realistic campaigns, short follow-up training for anyone who clicks, and reporting that shows risk falling.
Phishing simulation and training
Realistic campaigns, short follow-up training for anyone who clicks, and reporting that shows risk falling.
Vulnerability scanning Continuous, with a 14-day fix window for high-risk issues and an evidence trail.
Vulnerability scanning
Continuous, with a 14-day fix window for high-risk issues and an evidence trail.
Microsoft 365 hardening Conditional access, audit logging, safe defaults and Secure Score tracked every quarter.
Microsoft 365 hardening
Conditional access, audit logging, safe defaults and Secure Score tracked every quarter.
Policies that match reality A written IT security policy, acceptable use policy and incident response plan that reflect how you actually work.
Policies that match reality
A written IT security policy, acceptable use policy and incident response plan that reflect how you actually work.
Incident response A plan written in advance, a team that already knows your estate, and backups that have been tested.
A plan written in advance, a team that already knows your estate, and backups that have been tested.
We use established, specialist products and run them ourselves. Naming them matters, because a security service is only as good as what sits underneath it.
We review the stack every year and change it when something better comes along.
Running mostly on Microsoft 365? Microsoft 365 Ultimate packages detection and response, email security, backup and training with your licence.
Questions we get asked
Managed detection and response is a 24/7 service in which a security operations team watches your devices and Microsoft 365 for signs of attack, investigates alerts, and contains threats at any time of day, for example by isolating a compromised laptop from the network.
Antivirus catches known malware. It doesn’t catch a valid sign-in with a stolen password, a legitimate remote access tool being misused, or an attacker who never drops a file at all, which is how most serious incidents now run. Detection and response exists to catch the behaviour, not the file.
The security operations centre investigates it. If it is malicious, the device is isolated from the network straight away and a ticket is raised with us. You will have an email waiting and a call first thing, not a surprise on Monday.
Done badly, yes. Done properly it is mostly invisible: single sign-on, multi-factor prompts that appear when risk changes rather than all day, and policies scoped so people can still do their jobs. If a control causes daily friction, it is the wrong control.
We arrange it through independent specialists rather than marking our own homework, then fix whatever they find. Continuous vulnerability scanning is included in the managed service.
Yes. Insurers increasingly ask multi-factor sign-in, patching, backup and endpoint detection. We can give you the evidence for each, and most of our clients find the questionnaire takes minutes rather than days.
Find out what an attacker would see.
We will review your Microsoft 365 and network and show you the gaps in plain English, with what to fix first.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
