Cyber Security for Business in Thetford

Why cyber security matters for Thetford businesses

Cyber attacks do not target only large corporations. Small and medium-sized businesses are frequently hit precisely because their defences tend to be lighter. A business running ten Windows PCs and Microsoft 365 holds enough valuable data - customer records, payment details, staff information, supplier contracts - to make it a worthwhile target for criminals operating automated attack tools that scan thousands of businesses at once.

The businesses that come off worst are usually the ones that assumed it would never happen to them. Getting the basics right before an incident is far cheaper and less stressful than dealing with the aftermath of a breach.

The warning signs that something is already wrong

Many businesses are compromised for weeks or months before they notice. Knowing what to look for can make the difference between catching a problem early and discovering it only when data has already left your network.

• Unexpected password reset emails. If Microsoft 365 or any business account sends a reset email you did not request, treat it as serious until proven otherwise. Someone may be attempting to take control of that account.
• Unfamiliar sign-in locations in Microsoft 365 audit logs. Microsoft 365 records where accounts are accessed from. A sign-in from an unexpected country or city, especially outside office hours, is a clear red flag.
• Colleagues receiving emails that appear to come from you internally. If your own domain is being spoofed, your email configuration may be missing SPF, DKIM or DMARC records. These are DNS settings that tell receiving mail servers whether a message genuinely came from your domain.
• Computers running noticeably slower than usual. Malware and ransomware use processor and memory resources. A sudden, unexplained slowdown across multiple machines can indicate background activity you have not authorised.
• Antivirus or Windows Defender alerts that are being dismissed without investigation. A single alert might be a false positive. Repeated alerts, or alerts that appear and then disappear without a clear explanation, usually mean something reached your system.
• Users unable to access files they could reach yesterday. Ransomware typically encrypts files progressively. The first sign is often that certain folders or file types become unreadable. By the time the ransom note appears, the encryption is usually complete.
• Unusual outbound network traffic. If your router or firewall logs show large amounts of data leaving the network at odd times, it may indicate data exfiltration - criminals copying your files before or after encrypting them.
• Emails in your Sent folder that you did not send. A compromised Microsoft 365 account is often used immediately to forward emails, reset passwords on linked services or send phishing messages to your contacts.

None of these signs on its own is definitive proof of a breach, but any of them warrants investigation rather than being ignored or explained away. The cost of checking is small; the cost of missing a real incident is not.

What causes these problems in the first place

Understanding the root causes helps you prioritise where to spend time and budget. Most incidents trace back to a small number of recurring weaknesses.

Weak or reused passwords remain the single most common entry point. When criminals obtain a credential list from a breached website - and billions of these are freely available on criminal forums - they run automated tools that try those username and password combinations against Microsoft 365, remote desktop services and business email accounts. If your staff reuse passwords across personal and work accounts, that breach from an unrelated site becomes your problem too.

Multi-factor authentication (MFA) not being enabled. MFA requires a second confirmation - typically a code on a phone app - before an account login succeeds. Without it, a stolen password is all an attacker needs. Microsoft 365 includes MFA at no extra cost; enabling it is one of the highest-value steps any business can take.

Unpatched Windows PCs and laptops. Microsoft releases security updates regularly, and some of those updates patch vulnerabilities that are already being actively exploited. A machine that has not applied updates for several months may be open to attack methods that were fixed long ago. Managed support contracts typically keep updates applied on a scheduled basis, which removes this as a standing risk.

Phishing emails that bypass basic spam filters. Modern phishing emails are often convincing. They may impersonate a supplier, a colleague or a cloud service your business uses. Staff who have not been shown what to look for - mismatched sender domains, urgent requests to transfer money or update payment details, links that go to lookalike login pages - are the most exposed. Training does not need to be elaborate, but it needs to happen.

No backups, or backups that have never been tested. Backups do not prevent an attack, but they determine whether you recover cleanly or pay a ransom. A backup that sits on the same network as the infected machine will often be encrypted alongside everything else. Offsite or cloud backups, verified by periodic test restores, are the only reliable safety net.

Overly permissive account access. If every member of staff has administrator rights on their Windows PC, a piece of malware run under their account has the same rights. Applying the principle of least privilege - giving each user only the access they genuinely need - limits the damage any single compromised account can cause.

What good cyber security controls look like in practice

Cyber security is not a single product you buy and forget. It is a set of layered controls, each of which reduces risk in a different way. For a business running Windows PCs and Microsoft 365, the practical baseline includes the following.

• MFA switched on for all Microsoft 365 accounts, including admin accounts
• Windows Defender or equivalent endpoint protection active and monitored, not just installed
• Windows and Office updates applied promptly and consistently across all devices
• Email security records (SPF, DKIM, DMARC) correctly configured for your domain
• Verified, offsite backups of Microsoft 365 data (Exchange, SharePoint, OneDrive) and any on-site file servers
• User accounts set to standard rather than administrator privilege where full admin is not needed
• A clear process for staff to report suspicious emails without fear of being criticised for asking
• Conditional access policies in Microsoft 365 that can block or flag logins from unexpected locations

Getting all of these in place takes time, but it is methodical work rather than complicated work. The priority should be to address the highest-risk gaps first, particularly MFA and backups, then work through the remainder in order of impact.

Threat monitoring - what it means and why it matters

Threat monitoring means having automated tools watching your systems continuously and alerting a support team when something looks wrong. For Microsoft 365 environments this typically covers unusual sign-in patterns, bulk email deletion, mailbox forwarding rules added without authorisation, and changes to admin permissions. For Windows devices it covers endpoint detection - watching for behaviour that suggests malware is running, even if that malware is new enough not to appear on a standard antivirus signature list.

The practical value of monitoring is speed. The faster a threat is detected, the smaller the window for damage. Without monitoring, many incidents are discovered by a member of staff noticing something odd - which may be days or weeks after the attacker gained access.

Support options and what they cost

Managed support contracts are priced per computer per month (excluding VAT). The Business Essentials plan covers unlimited remote and phone support, updates, backups and security monitoring. On-site visits are charged separately at a £60 call-out fee plus labour. Pricing scales with the number of computers: one computer is £36 per month; two to three computers are £31.20 each; four to nine are £25.20 each; ten to seventeen are £22.20 each; eighteen or more are £21.60 each.

On the Business Premium plan, one computer is £54 per month; two to three are £42 each; four to six are £38.60 each; seven to nine are £33.80 each; ten to twelve are £31.20 each; thirteen to fifteen are £28.40 each; sixteen to nineteen are £25.40 each; twenty or more are £24.40 each.

If a monthly contract does not suit your business, pre-paid time blocks are available. Blocks are valid for up to six months. A managed email service is also available and is quoted on request. All prices exclude VAT.

What to ask any IT support provider about cyber security

Before committing to a provider, it is worth asking some direct questions. Is MFA enabled on all accounts by default, or does it need to be requested separately? How are backups tested - and how often? What happens if a monitored alert fires outside your support hours? How quickly are Windows security patches applied after Microsoft releases them? Will you receive a clear report showing what is monitored and what was found?

A provider that cannot answer these questions clearly is unlikely to be doing the underlying work consistently.

Get cyber security in place for your Thetford business

If you have noticed any of the warning signs above, or if you simply want to understand how well-protected your current setup is, call us to arrange a security review. We have been providing IT support since 1990 and we work with businesses running Windows and Microsoft 365 across Thetford, Bury St Edmunds and nearby towns. Security is not a box-ticking exercise - it is an ongoing part of managing your IT well, and we can help you get it right.