Cyber Security for Business in Saffron Walden

What cyber security for business involves

For businesses running Windows PCs, laptops and Microsoft 365, cyber security is a practical set of controls: multi-factor authentication on all accounts, managed Windows patching, email filtering, monitored offsite backups and controlled user permissions. These controls, properly maintained, dramatically reduce both the likelihood of an incident and the damage if one occurs.

The gap between a business with proper controls and one without is not about the sophistication of the attacks they face - attackers do not choose targets by postcode or size. The gap is in how much damage a successful attack can do, and how quickly normal operations can resume.

What to do while you wait for IT support to respond

This section is for the moment you suspect something is wrong - a strange email, an account you cannot access, a machine behaving oddly, or a ransomware message on screen. Support is available during office hours. Here is how to use the time before help arrives.

Isolate the affected machine immediately

If one PC or laptop appears to be compromised, disconnect it from your network as quickly as possible. Pull the ethernet cable if there is one, or turn off Wi-Fi on the device. Do not turn the machine off unless you are specifically told to - in some cases, evidence needed for investigation exists only in the device's active memory and is lost on shutdown. Isolation prevents the problem spreading to other machines or network shares while you wait.

Stop using affected accounts

If you believe a Microsoft 365 account has been compromised - because of a suspicious login alert, unexpected sent emails or a password that no longer works - stop using that account immediately on all devices. Do not attempt to log in repeatedly, as this can trigger lockouts that complicate recovery. Note the account name and any unusual activity you have observed so you can report it accurately when support arrives.

Do not pay any ransom demand

If you see a ransomware message, do not pay. Payment does not guarantee decryption, frequently leads to repeat targeting, and in some cases the payment mechanisms themselves are fraudulent. Isolate the machine, contact your IT support, and do not interact with the ransom demand further. Your ability to recover depends on your backup situation, not on the attacker's goodwill.

Write down what you saw and when

Before memory fades, note the sequence of events: what appeared on screen, what time it happened, which machine was affected, what the user was doing immediately before. This information is genuinely useful for incident response and, if required, for reporting to the Information Commissioner's Office. A brief written account made at the time is far more useful than a recollection made hours later.

Alert your team without causing panic

Let colleagues know calmly that there is a potential IT issue and that they should avoid the affected machine and not click on anything unusual in their own inboxes until further notice. You do not need to explain the full situation - just enough to prevent the problem being inadvertently spread by someone clicking a related phishing email.

Check what your backups cover

If you have access to your backup management console or can reach someone who does, check the most recent successful backup. This tells you the worst-case data loss scenario if a full restore is needed. Knowing this before your IT support arrives means the initial conversation can focus on recovery options rather than fact-finding.

What not to do yourself during a cyber incident

The instinct to fix things is understandable but can make the situation worse. Avoid the following until qualified IT support has assessed the situation.

• Do not run antivirus scans on a suspected ransomware machine. On an actively compromised machine, running a scan can trigger further encryption or delete forensic evidence before it can be examined.
• Do not reinstall Windows yourself. A reinstall wipes the evidence of how the attack occurred, which matters both for understanding the entry point and for any regulatory reporting requirement.
• Do not change passwords from a machine that may be compromised. If a keylogger is present, the new password is captured immediately. Change credentials from a separate, clean device.
• Do not restore from backup without guidance. Restoring to an environment that is still compromised simply re-infects the restored data. The underlying vulnerability needs to be addressed first.
• Do not share details of the incident publicly - on social media or in emails - before you understand the scope. You may have legal obligations around notification that should be handled carefully and in the right sequence.

After the incident - getting proper controls in place

The period after an incident is the right time to review what controls were missing and put them in place properly. For Windows and Microsoft 365 environments, the most common gaps found after an incident are: no multi-factor authentication on admin accounts, no offsite backup (or a backup that had silently stopped running), legacy authentication protocols still enabled in 365, and end-of-support Windows versions still in use on the network.

Addressing these gaps is not a large project for most small businesses. It is a focused set of configuration changes, account reviews and policy decisions - the kind of work that takes a few hours with the right support and pays for itself the first time it prevents an incident.

Preventing the next incident - what good security looks like

A well-secured small business running Windows and Microsoft 365 has the following in place as a minimum:

• Multi-factor authentication enforced on all Microsoft 365 accounts, including admin accounts
• Windows devices kept current with security patches, applied and confirmed - not just scheduled
• Email filtering that blocks known malicious senders and scans attachments
• Backups stored in a separate environment from live data, with restore tests conducted periodically
• Leaver accounts disabled promptly and active sessions revoked
• Standard user accounts used for day-to-day work, admin rights reserved for administrative tasks
• External sharing on SharePoint and OneDrive reviewed and restricted to what is genuinely needed

What our service covers

We work with Windows PCs, laptops and Microsoft 365 only. Our managed cyber security service handles the ongoing work that keeps these controls effective: monitored patching, backup oversight, Microsoft 365 configuration management, email filtering, multi-factor authentication and account management. Support is available during office hours. A managed email service is also available.

Pricing

Contracts are billed per computer per month (all prices exclude VAT).

Business Essentials - unlimited remote and phone support, updates, backups and security monitoring. On-site visits charged at £60 call-out plus labour separately:

• 1 computer: £36/month
• 2 to 3 computers: £31.20 each/month
• 4 to 9 computers: £25.20 each/month
• 10 to 17 computers: £22.20 each/month
• 18 or more computers: £21.60 each/month

Business Premium - everything in Essentials, with on-site labour and call-outs included in the monthly price:

• 1 computer: £54/month
• 2 to 3 computers: £42 each/month
• 4 to 6 computers: £38.60 each/month
• 7 to 9 computers: £33.80 each/month
• 10 to 12 computers: £31.20 each/month
• 13 to 15 computers: £28.40 each/month
• 16 to 19 computers: £25.40 each/month
• 20 or more computers: £24.40 each/month

Prepaid time blocks without a monthly contract: 4 hours for £312, 8 hours for £592, or 16 hours for £1,123 (all ex VAT). Each block includes monthly monitoring and priority service and is valid for up to six months.

Serving Saffron Walden businesses from Bury St Edmunds

We have supported businesses from our Bury St Edmunds base since 1990, working with firms in Saffron Walden and the surrounding area, including Haverhill, Cambridge, Newmarket and beyond. If you are dealing with an incident right now or want to review your current controls, call us during office hours to talk through your situation.