Blog Details

Most breaches don’t start with sophisticated hacking. They start with a reused password, an unpatched laptop or a convincing email. This guide covers the five basics every business should check, the myth that small businesses aren’t targets, what antivirus, EDR, XDR and MDR actually mean, and what cyber insurers now ask for.

Five basics to check first

1. MFA everywhere: email, VPN, admin accounts and cloud apps. No exceptions for leadership.
2. Patching: are laptops, servers and firewalls on current updates?
3. Tested backups: a backup you’ve never restored is a hope, not a plan.
4. Email filtering: are suspicious messages stopped before they reach the inbox?
5. People: has your team had security awareness training in the last 12 months?

“We’re too small to be a target”

Most attacks aren’t targeted at all. Automated tools scan the internet for weak spots, such as an exposed remote desktop port, an unpatched firewall or a reused password, without checking your size first. Smaller businesses can even be more attractive: they’re less likely to have 24/7 monitoring, security often sits with one busy person, and they connect to larger customers and suppliers. Size doesn’t decide whether you’re attacked. Preparation decides how much it costs you.

Antivirus, EDR, XDR and MDR, explained simply

• Antivirus: blocks known malware. Essential, but on its own it mostly stops what’s already known.
• EDR (Endpoint Detection and Response): records what happens on each device, spots suspicious behaviour and lets your team investigate and contain an attack, for example by isolating a laptop.
• XDR (Extended Detection and Response): connects signals from endpoints, firewalls, email and cloud, so one attack shows up as one story instead of fifty alerts.
• MDR (Managed Detection and Response): a service, not just a tool. Security analysts watch your EDR and XDR data around the clock and respond for you.

The simple rule: antivirus and EDR are tools, XDR makes them work together, and MDR adds the people who watch them. Attackers know when offices are empty, so nights, weekends and holidays are when an alert most needs someone watching.

What cyber insurers will ask

Insurers increasingly ask for evidence of: MFA on email, remote access and admin accounts; EDR, not just antivirus; offline or immutable backups with tested restores; how quickly critical updates are installed; staff phishing training; and an incident response plan. A “no” can mean a higher premium, exclusions or no cover, and answering “yes” when it isn’t true can put a claim at risk. Treat the questionnaire as a free security checklist.

Five preventable IT horror stories

• The backup that wouldn’t restore. Fix: test restores every quarter.
• The ex-employee whose account still worked. Fix: remove access on the last day.
• The “urgent” payment email from the CEO. Fix: confirm payment changes by phone.
• The server that died out of warranty. Fix: an asset register with warranty dates.
• The password that opened everything. Fix: MFA on email, remote access and admin accounts.