Three people reviewing the security position of a company in a meeting room

Your SME has an IT partner, but do you know how secure your business really is?

Backups, access, bank details: day to day, everyone relies on someone else having checked. Whether that is true usually shows only in an emergency, when one click stops the business or a payment lands with the wrong people. Where do you stand today?

31 questions, about 10 minutes. Independent of vendors. No replacement for your IT partner. Confidential.

Problem

Most SMEs only find out in an emergency how secure their business really was.

Monday morning, accounting reports that the server won't start and every file has a strange extension. Or a long-standing supplier writes that their bank details have changed, and the next payment of EUR 30,000 goes to a stranger's account. Or an employee who left six months ago can still log into the company mailbox. In smaller companies it is rarely a sophisticated attack. It is almost always a gap everyone assumed someone else was taking care of.

Until then everything feels safe, because nothing happens. And when it does, operations stop for days, customers wait, and nobody ever answered the question of who was responsible.

Hypothesis

The obvious answer: «That's what our IT partner is for.»

That is the obvious answer, and it sounds reasonable. There is antivirus, a firewall and a backup every night. The IT partner sends an invoice for maintenance once a year, and as long as the screens work, everything seems fine.

If something is missing, you buy another tool: a better spam filter, a pricier firewall, maybe cyber insurance. Security is seen as a technical topic you hand over to specialists. Whether all of it actually holds when it counts is a question hardly anyone asks, because nobody has to.

Antithesis

What is missing is rarely technology. It is checking and accountability.

Most incidents in SMEs don't happen because a tool is missing, but because of untested assumptions. A backup that runs every night but was never restored, and in an emergency it turns out accounting was never included. A former employee who still has access, because nobody keeps a list. A bank account changed by email, because there is no rule for calling back.

Your IT partner implements what was agreed, and usually does it well. But nobody checks whether what was agreed is enough. And which risks your business is willing to carry is a decision only management can make, not the technology.

Diagnosis

Three questions that show where you stand.

If you cannot answer one of these questions with certainty, the ten minutes for the check are worth it. They turn a vague feeling into a written picture of where your business stands, in plain language.

«When was your backup last fully restored?»

If you don't know, your backup is an assumption.

«Who has access to your systems today, including from outside?»

If nobody has a list, old doors are open.

«What happens when a supplier emails new bank details?»

If they are simply changed, chance decides about your money.

Mechanism

How we work: assess, prioritise, verify.

We don't sell hardware or software and are not tied to any vendor. That is why we have no interest in offering you yet another tool. Our work is good when you know where you stand, your IT partner knows what to do, and both are written down.

Assess

We look at your company like an auditor, not a salesperson: configuration, access, backups, suppliers, processes.

Prioritise

You get a clear order in plain language, split into what you decide as management and what your IT partner implements.

Have it implemented

Your IT partner implements. We don't replace them, we give them clear instructions.

Verify

We check that what was agreed has been done, and record it so you can show it to clients, auditors and your insurer.

Examples

What this looks like in practice

The backup ran every night. Nobody had ever restored it.

Illustrative case: a machine builder with 60 employees. Name and details are invented, the pattern is typical.

The managing director was certain: the IT partner backs up all data every night. That was true. The check showed, however, that nobody had tested a full restore in three years, and that the backup sat in the same network as the servers. Ransomware would have hit both at once.

In the results call we translated this into business terms: how many days does production stop if order data and drawings are gone? The honest answer was at least two weeks. That became a clear brief for the IT partner: a separate backup and a restore test every quarter.

The first test showed that a drive with design data was missing from the backup. Found in a test, not in an emergency. Today there is a short proof after every quarter that the managing director can also show his insurer.

A new bank account by email. 48,000 euros almost disappeared.

Illustrative case: a trading company with 25 employees. Name and details are invented, the pattern is typical.

A long-standing supplier wrote that his bank had changed and asked for the next invoice to go to the new account. Sender, logo and tone all matched. Accounting had already prepared the payment. Only because the approval happened to sit with the owner, who knew the supplier, did he call. The email was fake.

The check pointed to exactly this gap: there was no rule for who checks bank changes and how. Everything depended on individual gut feeling. The mailbox was well protected technically, the problem was the process.

The fix cost almost nothing: every change of bank details is confirmed by phone on a known number, and payments above a set amount need two approvals. The team was trained in one hour. Since then two more fake requests have been caught, both by employees, not the owner.

The former employee still had access. For seven months.

Illustrative case: an accounting firm with 15 employees. Name and details are invented, the pattern is typical.

Asked who has access to the systems today, the check got an honest answer: nobody knows exactly. A list showed that an employee who had left seven months earlier still had access to the client portal and cloud storage. On top of that, two external providers still had admin rights long after their work had ended.

Nothing had happened. But for a firm that handles clients' tax data, this is exactly the gap clients, regulators and insurers ask about. The problem was not technology, it was that nobody owned access when someone left.

Today there is a leaver checklist with a clear owner, every login uses a second factor, and once a quarter management reviews an overview of all permissions. It takes ten minutes. The IT partner implements, we check that it stays that way.

Next step

If you recognise yourself in this picture, let's look at it together.

Start with the free Cyber Security Check. You receive a personal report with your most important findings, and we go through it with you in 60 minutes.

You end up with a written basis instead of a gut feeling: which points in your business need clearing up first, what an incident could cost you, and what your IT partner can implement concretely. Whether you work with us afterwards is a separate decision.

Senad Džananović

Cyber Security Director

True cybersecurity excellence isn't just about implementing the latest technologies. It's about building a culture where security becomes an intrinsic part of every business decision, empowering organizations to grow confidently in an increasingly digital world.

Where are you today?

The Cyber Security Check

This is where the check starts. Your answers describe your day-to-day: backups, access, payments, emergency plan. From them we see where your business is vulnerable today.

31 short questions, about 10 minutes. You receive a personal report by email with your most important findings. In the free results call we then put your answers into context together.