Cybersecurity for SMEs
Discipline before tooling.
Companies rarely fall to sophisticated attacks. They fall to a plaintext password, a forgotten staging server, an access that was never revoked. We map your real attack surface, then reduce it methodically, without turning your teams' daily work into an obstacle course.
Attack surface mapping
What is exposed to the internet, often without your knowledge: forgotten subdomains, open ports, public repositories, leaked credentials.
Prioritised by business risk
We do not deliver a list of four hundred vulnerabilities. We deliver the twelve that can genuinely cost you dearly, ranked by impact.
NIS2 and GDPR compliance
Operational compliance, not merely documentary: registers, procedures and evidence of application.
Incident response prepared
Crisis plan, escalation chain, simulation exercises. You should not discover your procedure on the day of the attack.
Our method
External reconnaissance
We look at your company as an attacker would: what is visible, what is exploitable, and where a motivated actor would start.
Internal audit and configuration review
Permissions, network segmentation, backups, logging, secrets management. The devil is in the configuration.
Guided remediation plan
Each fix is costed in effort and time, prioritised, then implemented alongside your teams.
Frequently asked questions
The NIS2 directive considerably widens scope compared to NIS1 and reaches many small and mid-sized companies in sectors such as digital, health, food and transport. A half-day scoping session settles the question.