Service 01
Business Protection Review
Most owners of established businesses know cyber risk matters. Fewer have an independent view of where their business actually stands, or what would happen to cash flow, customers and production if something went wrong.
The Business Protection Review gives you that view. We examine your technology, your payment processes and your resilience arrangements together, because that is how attackers and disruption find their way in.
Who it is for
- Owners and directors who want an honest, independent view of their exposure
- Businesses whose IT is handled by a small provider or a capable member of staff, without a dedicated security specialist
- Finance directors concerned about invoice fraud and supplier impersonation
- Businesses preparing for customer due-diligence questionnaires, insurance renewals or tenders
What it covers
Areas we look at
Cybersecurity posture
A practical look at your devices, network, cloud services and how they are configured and maintained.
User access and permissions
Who can access what, who has administrator rights, and whether leavers are removed promptly.
Multi-factor authentication
Where MFA is in place, where it is missing and which accounts matter most.
Email security
Protection against spoofing, phishing and mailbox takeover, the most common route into an SME.
Backup and recovery
Whether backups exist, are protected from ransomware, and can actually be restored in a sensible time.
Supplier payment fraud
How bank-detail changes, payment approvals and urgent payment requests are handled in practice.
Business continuity
What would happen to orders, production, dispatch and payroll if key systems were unavailable for a week.
IT provider arrangements
What your IT provider is and is not responsible for, and where the gaps sit between you.
Staff awareness
How well your people recognise and report suspicious emails, calls and payment requests.
How it works
A clear process from start to finish.
- 1
Scoping call
We agree what is in scope, who we need to speak to and a fixed fee.
- 2
Information gathering
Short interviews with key people, a review of settings and documents, and a light-touch technical review.
- 3
Analysis
We assess the technical findings alongside the commercial consequences.
- 4
Report and debrief
You receive the report and we walk the directors through it, answering every question.
What you receive
- A written report explaining your risks in plain English, not technical jargon
- A prioritised action plan: what to fix now, what to plan for and what can wait
- A view of the likely financial and operational impact of the main risks
- Practical recommendations you can give to your IT provider or ask us to deliver
- A face-to-face or video debrief with the directors
FAQs
Business Protection Review: common questions
How much of our time does the review take?
Usually a few hours in total: a short kick-off, interviews of around 45 minutes with two or three key people (typically a director, someone from finance and whoever looks after IT), and the debrief. We work around production and busy periods.
Do you need access to our systems?
We need read-only visibility of key settings, such as your email and Microsoft 365 or Google Workspace security configuration, backup arrangements and user lists. We agree exactly what access is needed in advance and never make changes during a review.
Will this upset our IT provider?
It shouldn't. We are not trying to replace them. Most good IT providers welcome an independent view, and we share findings in a constructive way that helps them help you.
What if you find something serious?
We tell you straight away rather than waiting for the report, explain what it means in plain English and suggest the immediate steps to take.
Is the review the same as Cyber Essentials?
No. Cyber Essentials checks a set of core technical controls. The review is broader: it also covers payment fraud, financial controls, business continuity and your IT provider arrangements. Many clients use the review to prepare for Cyber Essentials.
Other services
Related ways we can help
Security Improvement Programme
A practical, managed programme to fix the vulnerabilities that matter most.
£4,000 – £8,000
03Ongoing Protection Partner
Independent, senior oversight of your cyber, fraud and resilience risks, without a full-time hire.
£500 – £750 per month
ISO 27001 consultancy
Practical ISMS implementation and certification readiness for customer and tender requirements.
Next step
Start with a conversation about your business.
An introductory conversation costs nothing. We will listen to where your business is heading, talk through what is holding it back and tell you honestly whether and how we can help.
30 to 45 minutes, by video or in person
At a time that suits you.
A conversation, not a sales pitch
We want to understand your business first.
A clear proposal
If we can help, you will know what we suggest and what it will cost.