Reference library
Microsoft 365 and cyber security, explained properly
Twelve reference pages written for UK small businesses. No gated downloads, no lead forms, no vendor spin — including the parts that argue against buying from us.
Microsoft 365
Microsoft 365 licensing for small businesses, explained properly
Most UK small businesses need one of three Microsoft 365 plans. Business Basic gives web and mobile Office apps plus email and Teams. Business Standard adds the installed desktop Office applications. Business Premium adds the security and device management layer — Microsoft Entra ID P1, Intune, Defender for Office 365 Plan 1 and Defender for Business. All three are capped at 300 seats per tenant. The most common and most expensive licensing mistake is not choosing the wrong plan but failing to reclaim licences from people who have left, and buying standalone add-ons that Business Premium already includes.
Read →
Microsoft 365 security: the settings that actually reduce risk
The majority of Microsoft 365 breaches in small businesses are not sophisticated. They are password-based account takeovers that succeed because multi-factor authentication was not enforced everywhere, legacy authentication protocols were still enabled, or an administrator was working day to day from an account with global privileges. A defensible small business baseline is roughly eight changes, most of which are free with any Microsoft 365 plan, and can be completed in an afternoon.
Read →
Copilot for Microsoft 365: what it does, what it costs you, and what to fix first
Microsoft 365 Copilot is a generative AI assistant embedded in Word, Excel, PowerPoint, Outlook and Teams that can reason over your own organisational content through Microsoft Graph. It respects existing Microsoft 365 permissions — which is exactly the problem for most small businesses, because those permissions are usually far looser than anyone realises. Copilot does not create an oversharing problem; it makes an existing one instantly discoverable by every employee. Fix permissions before you buy licences, not after.
Read →
Multi-factor authentication: the control that matters most, done properly
Multi-factor authentication is the single highest-impact security control available to a small business, and Microsoft has stated it blocks the overwhelming majority of automated account compromise attempts. But not all MFA is equal: SMS codes are meaningfully weaker than an authenticator app, and both can be defeated by an adversary-in-the-middle phishing kit that steals the session token rather than the password. For accounts that control money or administration, phishing-resistant methods — passkeys, FIDO2 security keys, certificate-based authentication — are the only reliable answer.
Read →
Conditional Access: policies a small business should actually deploy
Conditional Access is Microsoft Entra ID's policy engine: it evaluates who is signing in, from where, on what device, to what application, and then allows, blocks or challenges the attempt. It requires Entra ID P1, which is included in Microsoft 365 Business Premium. For a small business, five well-chosen policies deliver most of the available benefit — and one mandatory precaution, a break-glass account, prevents the failure mode where a policy locks every administrator out of the tenant at once.
Read →
Identity protection: securing accounts as the new perimeter
For a business running entirely in Microsoft 365 and SaaS, there is no network perimeter left to defend — the only thing standing between an attacker and your data is an identity and what it is allowed to do. Identity protection means four disciplines: keeping privileged accounts few and separate, removing access the moment someone leaves, controlling non-human accounts, and verifying who you are talking to before you change anything. Most small business breaches trace back to a failure in one of those four, not to a missing security product.
Read →
Cyber security
Business email compromise: how the invoice fraud actually works
Business email compromise is the most financially damaging cyber attack affecting UK small businesses, and it involves almost no technical sophistication. An attacker gains access to a mailbox, watches quietly for days or weeks, learns how the business talks about money, and then intervenes in a genuine payment conversation with new bank details. Because the email comes from a real account in a real thread, every technical control passes it. The defences that work are procedural — out-of-band verification of any bank detail change — backed by mailbox controls that limit how long an intruder can watch.
Read →
Cyber Essentials: what it requires and whether it is worth it
Cyber Essentials is a UK government-backed scheme, run by IASME on behalf of the NCSC, covering five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The basic level is a verified self-assessment; Cyber Essentials Plus adds independent technical testing of the same controls. It is mandatory for many central government contracts, increasingly required in commercial supply chains, and its main practical value for a small business is that it forces you to write down what you actually have.
Read →
Email security: SPF, DKIM, DMARC and what they do not protect you from
SPF, DKIM and DMARC are three DNS-based standards that together let receiving mail servers verify that a message genuinely came from your domain and decide what to do when it did not. Implemented properly they largely eliminate domain spoofing and materially improve deliverability. They do not stop phishing from lookalike domains, and they do nothing at all against an attacker sending from a genuinely compromised mailbox — which is the most damaging email attack small businesses face.
Read →
Backup strategy for cloud-first businesses: what Microsoft does not do
Microsoft operates under a shared responsibility model: they guarantee the availability of the service, you remain responsible for your data. Microsoft 365's built-in retention — recoverable items, retention policies, version history — covers accidental deletion within limited windows, but it is not designed for recovery from ransomware, malicious insider deletion, or a discovery six months later that something important is gone. For most small businesses the gap is filled by third-party Microsoft 365 backup, and its value is entirely dependent on whether the restore has ever been tested.
Read →
Small business cyber security: a realistic first-year plan
Small businesses are attacked opportunistically and at scale, not because anyone chose them. That is good news, because opportunistic attacks are defeated by baseline controls rather than by expensive tooling. A realistic first year is roughly: enforce MFA and remove dormant accounts in week one; get backup, patching and a payment verification procedure in place in the first quarter; add certification, staff awareness and a written incident plan across the rest of the year. Most of it is free or already included in what you pay Microsoft.
Read →
AI support
Get started
Open a chat. The AI picks up before the second ring — every time.
No onboarding calls. No sales process. Connect your devices and start raising tickets in under ten minutes.