Cybersecurity

The same care we put into wiring and panel work, applied to the digital side. We help businesses understand where they are exposed, harden the obvious gaps, and put real monitoring and response in place, without selling you a tool you do not need or a managed service you cannot afford.

Start with an assessment, not a product

Most security sales conversations start with a product. Ours starts with finding out what you actually have, because you cannot protect an environment nobody has mapped. A risk assessment and gap analysis covers what systems exist, what data they hold, who can reach them, what is exposed to the internet, where the backups are, and what would actually happen if a workstation got encrypted on a Friday afternoon.

The output is a prioritized list, ordered by risk against effort, with a plain statement of what each item costs to fix. Some of it we can do. Some of it is free and you can do it this week. Some of it is not worth doing for a business your size, and we will say so. A report that recommends everything is a report that has not made any decisions.

The unglamorous things that matter most

The controls that prevent the most damage for small and mid-sized businesses are not exciting, and they are not expensive.

Multi-factor authentication, everywhere it can go, starting with email. Email is the front door. The overwhelming majority of small-business compromises we see start with a credential, not an exploit, and MFA on email stops most of that outright.

Patching on a schedule. Backups that have been restore-tested rather than assumed. Least privilege, meaning ordinary users are not local administrators and not everyone is a Microsoft 365 global admin. Network segmentation, so that the guest wifi, the security cameras, the HVAC controller, and the accounting workstation are not all on one flat network, which is the norm in buildings we walk into. Offboarding that actually removes access on the day someone leaves.

None of this sells as well as a dashboard. All of it works better.

Endpoint protection, email security, network

EDR and MDR deployment and tuning, which is mostly tuning. An EDR nobody has tuned generates alerts nobody reads, which is indistinguishable from having no EDR while costing more. Email security and phishing defense. Firewall and VPN hardening, and segmentation that reflects how the building is actually used.

We are deliberately vendor-neutral. If you already own a tool that does the job, the right answer is to configure it properly, not to rip it out for something we prefer.

Incident response

If something has already happened, the priorities are containment, evidence, and recovery, roughly in that order. The instinct to immediately wipe and reinstall the affected machine is understandable and often destroys the only record of how they got in, which means it happens again.

We will help you work out what was accessed, what has to be reported, and to whom. What we will not do is tell you a breach was smaller than the evidence supports. If we cannot determine the scope of an incident, we will say that plainly, because “we could not determine scope” is a legitimate finding and a false all-clear is not.

What we will not do

We will not sell you a compliance certification that does not exist, imply that any product makes you unbreachable, or scope a managed service larger than your risk justifies. Security vendors have an easy time selling to fear, and small businesses get sold expensive tooling they cannot operate while the basics stay undone. If your MFA is not turned on, buying an EDR is the wrong purchase.

Where this connects

Cybersecurity and managed IT overlap heavily, and if we run your IT, the security fundamentals are not a separate line item. Segmentation work also touches low voltage and alarm and access control, because in most buildings the cameras and door controllers are on the network too, and they are frequently the least patched devices in the building.