The blog
We take over other people’s IT for a living, so we see what gets left behind. These are the questions that come up most, answered properly, with the numbers where we have them.
For a ten person office it is usually one day’s work, which is £665 plus VAT, plus the cost of transferring the data. Bigger moves take longer. We look at your mailboxes before we quote, check every mailbox at both ends as it moves, and send you a report at each checkpoint, so you can see that nothing has been left behind.
If your website runs on WordPress, or anything else built on PHP, probably yes, until it has been updated. The fix is a newer version of PHP, and on most small business sites that is your web host’s job, so the first thing to do is ask them whether it has been done.
Probably, yes. Unless your domain has a DMARC record set to quarantine or reject, nothing tells other email systems to stop a forged message from your address. It takes a minute to check and an afternoon to start fixing, and the fix costs nothing but care.
From 1 December 2026, new Microsoft 365 Copilot Business licences bought through a Microsoft partner come with usage based billing switched on. Each person can use up to 4,000 Copilot Credits a month on the newer features, which is up to $40 a month on top of the licence. Admins can lower that limit, and for most small businesses they should.
Seven checks, about fifteen minutes, no cost and no technical knowledge needed. Each one tells you something specific, and each has a clear sign that something needs fixing.
Support starts the day our remote management software goes onto your machines, and antivirus with round the clock monitoring goes on at the same time. Everything else is in place within 30 days, and we sit down with you at 30, 60 and 90 days to check it is working the way you want.
They matter, but less than the red crosses on a scanner make it look. They protect the people visiting your site, they cost nothing, and most take a few minutes to add. They will not fix a hacked website or a weak admin password.
Check the notice period in your contract first, then confirm that you own your Microsoft tenant, your domain and your backups rather than your provider owning them. Get that straight and the switch itself is usually uneventful. Get it wrong and you find out at the worst moment that the keys are not yours.
It should be yours, in your company’s name, with at least one global administrator account that belongs to you rather than to them. You can check in about ten minutes. If the answer turns out to be no, that is fixable, and it is much easier to fix while you are still on good terms.
About £100 a month for a business of up to 30 staff, if we already look after your IT. That is for the whole business, not per user. It is that low because we can already see and control everything Cyber Essentials checks, and we bill it monthly on purpose, because a certificate that only gets thought about every twelve months is a certificate that expires.
For most businesses under about 60 people, outsourcing wins on cost and it is not close. One person on £32,000 costs you closer to £37,000 once employer National Insurance and pension are in. That is just the person. The software they need to do the job is thousands a year on top. Twenty users on our Secure level is £13,200 a year, with the tools included.
It is payment diversion fraud, timed for late on a Friday when a property completion is due and everyone wants to be out the door. The attacker has usually been reading the email thread for weeks. The control that stops it is a verbal check against a phone number you already held, never one taken from the email.
Ours is £42, £55 or £72 per user per month excluding VAT, depending on how much security sits in it. Almost nobody in this industry publishes a figure, so any industry average you are quoted is a guess. Here is ours, and what moves it.
Revoke the active sessions, then change the password, then check the mailbox rules. That order matters: changing a password on its own does not sign somebody out of a session they already hold, and the mailbox rule is what has been hiding this from you.
Only if the things you told the insurer you were doing were actually happening on the day you got hit. Your policy schedule lists them: multi-factor authentication, patching, endpoint protection, training, an incident response plan. If one of them was not true, a claim can be refused outright rather than reduced.
Probably not, not without some work first. Assessment accounts created on or after 27 April 2026 are marked against Requirements for IT Infrastructure v3.3, and multi-factor authentication is now mandatory on every cloud service that offers it. Miss it on one service and you fail the whole assessment.
Disable the account rather than delete it, revoke the active sessions as well as resetting the password, and get the devices back. The step almost everybody misses is the sessions: changing somebody’s password does not sign them out of the phone in their pocket.
Because the attacks are bought off a shelf now rather than built. Phishing kits are sold as a subscription, complete with convincing fake login pages and a dashboard showing how many people fell for it, so the skill barrier has gone. What stops them is multi factor authentication on everything, filtering that catches what Microsoft misses, and staff who have been given permission to be slow.
Usually it means an old breach at some company you once had an account with, not that somebody is inside your systems today. What matters is whether the password that leaked is still in use anywhere, and whether multi-factor authentication would make it useless if it is.
Prefer a reader? Subscribe to the RSS feed. No email address, no list, nothing to unsubscribe from.
Next step
Ring the number below and you get Tom, the owner. If it’s a five minute answer you’ll get it on the phone, and there’s no expectation of anything after that.
Based in Cardiff, working across Wales and the West.
