IT security for small and mid-size companies
In small companies, most incidents start with a phishing email, a weak or shared password, or a backup that doesn't restore. We close those gaps first: firewall and access rules, Microsoft 365 and Defender settings, email authentication, phishing simulations and backups that are tested.
When this helps
- Nobody has reviewed the firewall rules or admin accounts in years.
- Emails from your domain land in spam, or could be spoofed.
- You don't know how your team would react to a convincing phishing email.
- Backups exist, but nobody has tried restoring one.
How we do it
- 1
Review
Firewall rules, admin accounts, Microsoft 365 and Defender settings, email authentication and backups.
- 2
Fix by priority
The changes that reduce the most risk come first, each one documented and reversible.
- 3
Test people, not only systems
Phishing simulations with Microsoft Defender Attack Simulation Training, followed by short training.
- 4
Prove the backups
A real restore test, so you know how long recovery takes.
What you get
- A security review with priorities
- Hardened firewall, Microsoft 365 and Defender settings
- SPF, DKIM and DMARC for your domain
- Phishing simulation results and training
- A tested backup restore
Questions
Why do our emails land in spam?
Often because SPF, DKIM or DMARC are missing or misaligned, or because the sending server is on a blacklist. We have fixed exactly this for a client domain through Cloudflare DNS.
Are phishing simulations safe?
They run inside your own Microsoft 365 tenant with Defender Attack Simulation Training, with management's agreement. Microsoft doesn't store the passwords people type into the simulated pages.
Do you do penetration testing?
No. We focus on configuration, hardening and awareness. For a formal penetration test we recommend a specialised firm.