A security audit that names the actual holes
Accounts without two-factor, passwords shared over Messenger, an admin login belonging to someone who left in 2023, unpatched machines, open ports, backups sitting on the same server as the thing they are backing up. You get the list, ranked by what would hurt most.
Access control and clean offboarding
A record of who can reach which system, permissions cut back to what each role needs, two-factor on the accounts that matter, and a checklist that actually gets run when someone resigns. Ex-staff keeping access is the most common finding we make.
Email security beyond the spam filter
DMARC enforced so nobody can send invoices as you, phishing and spoofed-supplier attempts filtered, and a short briefing so your finance person knows what a changed bank detail email looks like. Payment fraud arrives by email far more often than by hacking.
Backup and disaster recovery you can prove
Backups of the site, databases, mailboxes and the files people keep on their desktops, held offsite and encrypted — plus a documented recovery order and test restores. A backup that has never been restored is a hope, not a plan.
Hardening across the whole setup
Firewall rules, web application firewall, malware scanning, SSL, admin panels locked down, unused services closed, and workstations kept patched. The website is one door of several, and attackers do try the others.
Helpdesk and incident response
Day-to-day support for accounts, devices, printers, new starters and the things that stop work. And when it is serious: containment, restore, root cause, credential rotation, warning removal, and an incident report written for owners rather than engineers.