“We’ve got IT support, so we’re covered, aren’t we?” I hear some version of this quite often.
Sometimes it comes from a business owner after something has gone wrong. Sometimes it comes up when a customer, insurer or tender asks about cyber security and the business realises they do not have a clear answer.
It is a fair question – if someone is looking after your laptops, email, Wi-Fi, printers and software, it is easy to assume cyber security is included.
Sometimes it is. Often, it is not.
IT support and cyber security are not the same job
Your IT support company may be doing a great job.
They might set up your devices, sort out your network, fix problems when they crop up, keep your systems patched and help when someone cannot access their email.
That work is important and most businesses would grind to a halt without it. Cyber security is related, but it is not exactly the same thing.
IT support usually focuses on keeping things working.
Cyber security focuses on reducing the chance of an attack, spotting suspicious activity, limiting damage and helping you recover if something does go wrong.
There can be overlap. Some IT companies do cyber security very well. Others are mainly set up for support, maintenance and troubleshooting.
The important thing is knowing which one you have.
A simple way to think about it
Your IT support company is like the maintenance team for a building.
They keep the lights on, fix the boiler, repair the doors and help everything run as it should.
A cyber security specialist is more like the security architect.
They look at the locks, cameras, alarms, access points and response plan. They check whether the building is likely to be targeted, where someone might try to get in, and what happens if they do.
You need the building to work. You also need it to be protected.
The problem for many small businesses is that they have the first part covered, but assume the second part is included.
The gap is not always obvious
Cyber security gaps do not always shout. There is no blinking light telling you your backups have not been tested for months.
There is no warning sign before a phishing email lands in someone’s inbox.
There is no obvious alert when a password has been reused, stolen or guessed.
There is no pop-up saying your Microsoft 365 account settings are weaker than they should be.
That is why this gets missed.
Small business owners already wear too many hats. Finance. HR. Sales. Operations. Customer service. IT.
Cyber security is often the hat nobody has time to wear properly because there is always something more urgent in front of them.
Until there is a problem.
“We’re only a small business”
This is another thing I hear a lot and again, I understand why.
If you run a small business, it is easy to imagine cyber criminals are only interested in large companies, banks, councils, hospitals or national brands.
That is not how most attacks work.
Many attacks are automated. They are not always aimed at one specific business. Attackers look for weak passwords, unpatched systems, poor email security, exposed remote access, missing MFA, and backups that have not been properly protected.
Small businesses can be attractive because attackers expect them to have fewer defences.
That does not mean you need enterprise-level cyber security. It does mean you need to know where the sensible risks are.
A useful question to ask your IT provider
If you already have IT support, ask them this:
“What happens if ransomware hits us at 11pm on a Friday?”
The answer will tell you a lot.
You are not trying to catch anyone out. You are trying to understand what is actually covered.
Listen for things like:
Do they monitor for threats out of hours?
Would anyone know quickly if something suspicious happened?
Are your backups protected from ransomware?
When were your backups last tested?
Who would make decisions during an incident?
How quickly could you get your systems back?
Would they help with cyber insurance evidence or Cyber Essentials?
A good IT provider should welcome that conversation. It helps everyone understand roles and responsibilities before there is pressure.
Where Black Swan fits
At Black Swan Cyber Security Solutions, cyber security is our focus.
We are not here to replace your IT support company. In many cases, we work happily alongside them.
They keep your systems running.
We help add the security layer around them.
That might include threat detection and response, stronger email security, endpoint protection, DNS filtering, backup resilience, Cyber Essentials support, or a simple review of where the gaps are.
Sometimes the answer is not a big project. Sometimes there are a few practical changes that make a meaningful difference.
The point is not to scare you into buying things you do not need.
The point is to help you understand what is covered, what is not and what would be proportionate for your business.
You do not need to become a cyber security expert
Most small business owners do not want a technical lecture.
They want to know:
Are we exposed?
What matters most?
What can wait?
What would reduce the risk without making life difficult?
That is a sensible way to look at cyber security.
You do not need every tool on the market. You do not need to panic. You do not need to become an expert overnight.
You just need a clear view of your current position and a practical plan for closing the most important gaps.
If you already have IT support, that is a good start.
Just do not assume it automatically means cyber security is covered too.
If you are not sure where your business stands, I am happy to have a straightforward conversation.
No jargon. No hard sell. Just a clear look at what is covered, what might be missing, and what makes sense next…
