Endpoints, email, and the people using them
Small businesses are the easy target.
Nobody is choosing you specifically. Automated scanning finds unpatched systems and exposed services indiscriminately, and a twelve-person firm in a Loop tower looks identical to a scanner as a twelve-person firm anywhere else — except it often holds client money or client data, and usually has less protection than the size of that responsibility implies.
What it costs
Endpoint protection, patching, MFA enforcement and email security are included at the $149 seat price under a managed agreement. Standalone security reviews and remediation are billed at $185/hour.
The unglamorous things that stop most of it
Multi-factor authentication on everything. Especially email. The overwhelming majority of small-business breaches we see start with a stolen or guessed password on an account without MFA. It is free with Microsoft 365 and it is the highest-value hour of security work available to you.
Patching, on a schedule. Automated attacks target vulnerabilities that were fixed months ago. Being current removes you from the bulk of that traffic entirely.
Genuinely separate administrator accounts. Day-to-day work should not run with rights that let malware install itself silently.
Backups a compromised machine cannot reach. Covered properly on the backup page, and it is the control that decides how bad the worst day gets.
Email is the front door
Nearly everything arrives by email. Filtering that catches the obvious, banners on external mail so a spoofed internal sender is visible, and SPF, DKIM and DMARC configured so other people's servers reject mail pretending to be yours.
That last one protects your customers and your name as much as it protects you. Being the business whose domain sent a fraudulent invoice is a reputational problem long after the technical one is fixed.
The scam that actually takes the money
Not ransomware — invoice fraud. Someone compromises a mailbox, reads quietly for a few weeks, and then sends a real-looking message changing the bank details on a genuine outstanding invoice. It clears your process because it is not fake enough to trip anything.
The control is procedural, not technical: any change to payment details gets verified by phone, on a number you already held, before anything moves. Write it down, tell your finance people it is a rule and not a suggestion, and it stops working. We include this in staff training because it is where the money actually goes.
Training that is not a slideshow
Twenty minutes on what a real phishing attempt looks like now — because they no longer have spelling mistakes, and AI removed the last obvious tell. Then simulated phishing so people find out in a safe way, without anyone being humiliated for clicking.
The goal is a culture where someone forwards a suspicious message rather than quietly deleting it, and where the person who clicked says so immediately. That single behaviour is worth more than most products.
What we will not do
We will not frighten you into a stack of overlapping tools. Most small businesses in Chicago get the great majority of their risk reduction from MFA, patching, decent endpoint protection, email filtering, segmented networks and unreachable backups — and those are largely things you already pay for or can enable.
If you need a compliance framework — HIPAA, CMMC, PCI, or a cyber-insurance questionnaire you cannot honestly answer — that is real work with real cost, and we will scope it rather than pretend a product covers it.
FAQ
Questions we get asked
Are small businesses really targeted?
Not targeted — found. Automated scanning does not care about your size, and small businesses generally have weaker protection, which makes them a better return for the same effort. Being small is not cover.
What is the single most valuable thing we can do?
Turn on multi-factor authentication for email and any remote access. It is free with Microsoft 365, takes an afternoon including telling everyone, and blocks the attack that starts most small-business breaches.
Is antivirus enough on its own?
No. Modern endpoint protection is necessary and it is not sufficient — it does not help against a valid stolen password, and it does not stop someone being talked into a bank transfer. Layers, not a product.
Our cyber-insurance form asks about MFA, backups and EDR. Can you help?
Yes, and this is a good reason to get in touch. Those forms are increasingly binding — answering optimistically can void a claim. We will tell you where you genuinely stand and what it costs to be able to answer honestly.
How do we stop invoice fraud?
A written rule that any change to payment details is verified by phone on a number you already held, never a number in the email. Plus MFA on mailboxes so they cannot be read in the first place. It is procedural and it works.
Do you handle HIPAA or CMMC compliance?
We handle the technical controls and the documentation underneath them, and we work alongside your compliance advisor for the rest. We will not claim a piece of software makes you compliant, because none does.
Ready when you are.
Ring us and describe the problem in plain English. We will tell you what it costs before anyone drives anywhere.