Services · Security
You don’t have to be big to be attacked.
One mistake is all it takes – by anyone, at any time. What do you do if something goes wrong?
Timeframe
1–2 weeks
Rough estimate – I adjust it after our first meeting.
Your time
Usually 1–2 hours in total
Basis
CIS – Center for Internet Security
The problem
Small companies are not too small to be hit.
Smaller companies are an increasingly common target – not despite being small, but precisely because they are. Fewer resources, older systems and a belief that “it won’t happen to us” that often replaces actual safeguards.
The British currency exchange company Travelex was hit by a ransomware attack over New Year 2019/2020, reportedly paid USD 2.3 million in ransom and later that year went into administration. The 158-year-old British logistics company KNP collapsed in 2023 after a ransomware attack that, according to the BBC, probably began with a guessed password – around 700 jobs were lost, although according to the administrators the company was already struggling before the attack.
But most affected companies never make the news – they are too small for that. One of the few that have spoken openly is the family business Petterssons Charkuteri in Boden, Sweden: in 2022 its business system, accounting and all 3 backups were encrypted. They refused to pay a ransom of SEK 300,000 but estimated at least SEK 500,000 in costs to recover.
Much of it is automated: bots that continuously scan the internet for open doors, such as systems nobody has updated or login details from an old account nobody knew still existed. It requires neither advanced hackers nor large resources.
It is not a question of whether you will be targeted – it is a question of when, and whether you are ready.
Examples
What it can look like.
The old VPN solution
An accounting firm had its bookkeeping system encrypted in the middle of the year-end closing period – not because it was singled out, but because it had an old VPN solution nobody had updated in 3 years.
The same password everywhere
A property company’s email addresses turned up in a data breach, and employees used the same password at work as in their private lives. The attackers were in before anyone noticed.
Accounts nobody misses
Old admin accounts, former employees or suppliers with active access – open doors nobody has noticed.
What is included?
This is what I review.
A security review doesn’t have to be a big project. As a basis I use CIS – Center for Internet Security – a global framework of concrete security controls that is an industry standard. I combine automated scans with a manual review, without technical jargon and without unnecessary scaremongering.
Email security
Is your domain correctly configured? Can someone send email in your name without you noticing?
Exposed services
Which systems and ports are visible from the internet? Are they up to date?
SSL certificates
Are your certificates valid and correctly configured?
Data breaches
Have your email addresses or your domain appeared in known data breaches?
User accounts
Are there old admin accounts, former employees or suppliers with active access?
Backup and recovery
Is there a plan? Has it been tested?
Supplier access
Which external parties have access to your systems – and do they still need it?
What you get
You get a prioritised risk picture with concrete proposed actions, ranked by severity – not technical complexity. Not a 100-page report, but a basis for decisions: what is critical now, what can wait, and what it costs to do nothing.
Examples of measures
- Critical vulnerabilities identified and fixed
- Email security correctly configured – nobody can send email in your name
- Old accounts for former employees and suppliers removed or deactivated
- Backup tested and verified – you know you can actually restore your data
- A clear list of which external parties have access to your systems – and why
- Routines in place for what happens if something goes wrong
How it works
Timeframe: 1–2 weeks
Rough estimate – I adjust it after our first meeting.
Days 1–3
Automated scans of your domain, exposed services and email configuration. You don’t need to do anything.
Days 4–7
Manual review of user access, backup routines and supplier dependencies. Short conversations with the person responsible.
Week 2
Presentation of the risk picture and prioritised actions: what needs to be handled immediately and what can be planned in.
What do I need from you?
- A non-disclosure agreement (NDA), signed before anything starts.
- A responsible person for a few short conversations.
- Openness about user access, backup routines and which suppliers have access.
Next step
Do you know where you stand?
Guarantee: if I don’t add value, you get your money back. I don’t sell hours.