Cybersecurity Services | Business Protection

Most small businesses have a privacy notice on the website and very little idea where personal data actually sits. We work on the second half of that — the technical reality behind the paperwork:

Where this stops: we are not solicitors and we do not give legal advice. Lawful basis, contracts and data-sharing agreements, privacy notice wording and whether a specific incident is reportable are questions for a data protection solicitor or the ICO. Our job is to make the technical setup match the position your advisers take.

We do not carry out penetration testing in-house, and we would rather say that plainly than blur the line. Here is how it works when a client needs one:

• Penetration testing is a specialist discipline — qualified testers, a defined scope, and a formal report. It is not the same as a security assessment, and a package that quietly conflates the two is not selling you a pen test
• Where you genuinely need one, we refer you to a specialist partner who does it properly, and we are open about the fact that it is their work rather than ours
• We stay on your side of it: helping define a sensible scope, making sure the environment is ready to be tested, and interpreting the report afterwards in plain English
• We then remediate what the test finds, which is where most of the practical value sits and is squarely our own work
• If the basics are not yet in place, we will say so before you spend the money — a pen test against a business with no multi-factor sign-in and unpatched machines produces an expensive statement of the obvious

A pen test earns its cost when you run your own web application, hold particularly sensitive data, or have been asked for one by a client, insurer or tender. For most small businesses, closing the basic gaps first delivers far more protection per pound.