I’ve spent a big part of my career on the IT support side.
Keeping things running. Fixing what breaks. Helping people get through the day without tech getting in the way.
Most IT providers do that really well.
But cyber risk behaves differently. It doesn’t crash loudly. It sits quietly in the background, often in places no one’s actively watching.
That’s where we tend to see the gaps.
Not because anything’s being done badly. Just because the focus is different.
1. Alerts no one is actively watching
Most businesses already have antivirus or endpoint protection.
What they don’t always have is someone watching what it’s trying to say.
Alerts build up. Dashboards fill. Notifications get ignored because there’s always something more urgent.
We’ve seen suspicious behaviour sit there for days simply because no one had time to dig into it.
This is where managed detection and response makes the difference (We recommend Huntress EDR & Heimdal MXDR)
2. Microsoft 365 security left at default
Microsoft 365 is one of the biggest attack surfaces for small businesses.
Out of the box, it works – but it’s fairly open.
Things we often find:
- No conditional access
- MFA not enforced properly
- Admin privileges wider than they should be
- No visibility on risky logins
It’s usually not intentional. It’s just never been revisited after setup.
This is exactly what we address on our Microsoft 365 security pages
3. Backups that exist… but aren’t tested
Backups are one of those things people feel confident about.
Until they need them.
We’ve walked into situations where:
- Backups were running
- No one had tested a full restore
- Recovery took far longer than expected
Backups only count if they work under pressure.
We always pair backup with recovery testing and ransomware protection.
4. Identity is the new perimeter (but not being monitored)
Most protection still focuses on devices.
Attackers focus on identities.
If someone logs in successfully, many systems assume everything is fine.
What’s often missing is visibility of:
- Impossible travel
- Suspicious login patterns
- Privilege escalation
- Session hijacking
This is where a lot of modern attacks slip through quietly.
This is where identity detection and response comes in
5. Email security that stops spam, but not real attacks
Most setups catch obvious junk.
But that’s not what’s causing the damage anymore.
What we see now:
- Invoice fraud
- Supplier impersonation
- Compromised accounts sending “normal-looking” emails
These land in inboxes because they look legitimate.
API-based email security changes this completely
6. Patching that isn’t prioritised by risk
Patching is usually happening.
But it’s often:
- Scheduled rather than risk-based
- Delayed due to compatibility concerns
- Missing third-party apps and edge devices
Attackers don’t wait for maintenance windows.
If something critical is exposed, it gets used quickly.
7. No clear plan when something goes wrong
This is the one that only shows up under pressure.
When something happens:
- Who makes the call?
- What gets isolated?
- Who communicates with staff or customers?
Without a plan, time gets lost and that’s what attackers rely on.
Where this leaves most businesses
When you step back, it’s rarely about missing tools.
It’s about:
- Who’s watching
- Who’s responding
- And whether everything is working together
IT support keeps the business running.
Cyber security is about being ready when something doesn’t.
We see this across businesses in Chesterfield, Sheffield and the wider Derbyshire and South Yorkshire areas every week.
If you want a second set of eyes on what’s already in place, we’ll give you a straight answer – no noise, no pressure.
Just clarity on where you stand.
