Cyber security for small businesses, from someone who’s done it at enterprise scale
Most small businesses don’t need a security team. They need to know where they’re exposed, fix the few things that matter, and prove it when a customer asks. That’s what we do.
For businesses with 1–50 staff, firms selling to larger companies or bidding for contracts, and charities and community organisations that hold personal or donor data.
Website Risk Report
Free scan, full report from £195
Start with a free scan of your website and email settings, and you receive an overall grade and your top three risks by email. The full report goes deeper once you confirm you own the site. It explains each risk in plain English: what it could cost your business, how much effort the fix takes and who should do it. It is written for owners and directors, not IT teams, and includes a 30-minute call.
£195 for one website, £395 for up to three.
Add Website Risk Monitoring from £29 a month for monthly rescans, alerts when something changes and a quarterly executive report.
Cyber Health Check
From £495
Everything in the Website Risk Report, plus a check of the places inside the business where small firms usually get caught out. We review your Microsoft 365 or Google Workspace settings together on a 60-minute screen-share: you stay signed in and in control, and we never ask for your passwords. Nothing is done without your written permission.
- The full Website Risk Report for your main website
- Microsoft 365 or Google Workspace: multi-factor login, admin accounts, leavers’ accounts, file sharing, email forwarding and connected apps
- Backups, devices, antivirus, passwords and who has access to what
You get a plain-English report with a red, amber and green score, your top ten fixes in priority order, and a 30-minute walkthrough call. £495 for up to 10 staff, £795 for 11–50 staff. Usually delivered within two weeks.
AI Safe Use Pack
£695 for up to 20 staff. Let your team use AI without putting your data at risk.
Your staff are probably already using ChatGPT, Copilot, Gemini or the AI features built into apps you pay for. Often nobody has decided which tools are allowed or what information can go into them, and customer details pasted into a free AI tool can break data protection rules and your contracts. We find out what is really happening and give you simple rules your team can follow.
What we do
- A short questionnaire for you and a sample of staff, plus a 30-minute call: which AI tools are used, by whom and for what.
- Check each tool’s business terms: whether it trains on your data, how long it keeps it, where it stores it, and whether a business plan fixes the problem.
- Rate the risks against public UK guidance from the ICO and NCSC.
- Write your rules and walk you through them.
What you get
- A one-page AI risk summary with your top risks and quick wins
- An AI acceptable use policy tailored to your business
- An approved and banned AI tools list, showing what data each tool may handle
- An AI use register for recording new uses as they come up
- A one-page staff guide: what to do, and what never to paste into AI
- Optional: a 45-minute online staff briefing for £195
Usually delivered within two weeks. This is practical guidance aligned with public UK guidance, not legal advice. Where a use of AI raises a legal question, such as decisions about individuals, we flag it for specialist advice.
Not ready yet? Download our free AI policy template.
Fractional Security Lead
From £750 a month. Your part-time security manager, without hiring one.
For businesses that handle customer data, sell to larger companies or simply want someone senior responsible for security and safe AI use. We spend up to 8 hours a month on your business, mostly remotely, and you always know your top risks and what is being done about them.
| When | What we do | What you get |
|---|---|---|
| Month 1 | Run a full Cyber Health Check, agree your top risks, write or update your core policies, including AI use | Health Check report, risk register, 12-month security roadmap, and a policy pack: information security, acceptable use, AI use, access and passwords, backup, incident response, supplier security |
| Every month | 45-minute check-in, track roadmap actions, review Website Risk Monitoring results, vet new suppliers, apps and AI tools, answer security questions by email | A one-page monthly update; email answers within two working days |
| Every quarter | Review who has admin access and remove leavers, run a 30-minute online staff awareness session, update your approved AI tools list, handle customer security and AI questionnaires within your hours | A plain-English quarterly risk report for the owner or board |
| Every year | Repeat the Health Check, review policies, run a 60-minute incident drill | An updated roadmap and evidence for customers, insurers and auditors that you take security seriously |
| If something goes wrong | Advise on next steps, coordinate with your IT provider and insurer | Senior advice the same evening or next working day |
Not included: hands-on IT support, 24/7 monitoring or penetration testing; we can arrange a specialist partner at extra cost. Extra hours are £95 an hour. £750 a month for up to 20 staff; larger businesses are quoted. Three-month minimum, then monthly.
Cerniq Protect
ESET licence plus £4 per device a month
Business-grade protection from ESET, set up and looked after for you. We supply the ESET PROTECT licences, install them on laptops, desktops and servers, review alerts on working days and send you a monthly health report. Cerniq is an official ESET partner.
Supplier Security Pack
Add-on, from £395. Get through your customer’s security checks and win the contract.
When a larger customer or partner is about to sign with you, their security or procurement team often sends a questionnaire: 50 to 300 questions about how you protect their data. Blank, vague or wrong answers can stall the deal or lose it. We prepare your answers with you, fix the quick gaps first, and leave you ready for the next one. That includes the AI questions customers now ask: which AI tools you use and what happens to their data.
What we do
- Kick-off call (45 minutes): we go through the questionnaire, the deadline and what’s at stake.
- Fact-finding: you complete a short checklist about how you handle data, logins, backups and devices. With your permission, we check key settings ourselves.
- Draft answers: we write clear, honest answers in the language reviewers expect. Where the honest answer is “no”, we suggest a quick fix or a truthful “planned by [date]” answer.
- Review call (30 minutes): you check and approve every answer. You submit the questionnaire, because the answers are your company’s statements.
- Follow-up: we help with one round of clarification questions from your customer’s security team.
What you get
- The completed questionnaire, ready to submit
- A gap list showing what to fix before you submit and what can follow later
- A one-page Security Overview of your business to send future customers before they ask
- A reusable answer library, so the next questionnaire takes an hour, not a week
£395 for up to 100 questions; £695 for larger questionnaires or when you also need core policies written. Usually delivered within 5–10 working days. We never write an answer you can’t stand behind.
How we work
Everything is agreed in writing first: scope, access and price. We use read-only access wherever possible. Penetration testing isn’t done in-house; if you need one, we scope it and manage a specialist partner. We reply within one working day, and calls are available in the evenings.
Do you work outside the West Midlands?
Yes, remotely across the UK. On-site visits are available in the Midlands.
Will you try to sell us expensive tools?
No. Most fixes use what you already pay for.
Not sure which you need?
Book a free 20-minute call and we’ll tell you honestly.