There’s a question I get asked occasionally, usually by someone who’s just had a difficult experience with another IT provider.
“How do I know you’re recommending this because it’s right for me, and not because it’s right for your margins?”
It’s a fair question. A completely fair question and I’d rather answer it directly than pretend it doesn’t exist.
The problem with how most IT recommendations work
Most managed service providers choose their vendor stack based on a combination of factors and client outcomes are not always top of the list.
Partner programmes matter. Margin matters. Volume rebates matter. The ease of integrating a new tool into an existing platform matters. The sales rep who took someone to lunch matters.
None of that is necessarily sinister. It’s just how commercial relationships work. But it creates a quiet conflict of interest that most clients never see and never think to ask about.
The result is that businesses end up running security tools chosen for reasons that have nothing to do with whether those tools will actually protect them.
I’ve seen businesses paying for endpoint protection that wouldn’t detect a threat that’s been active in the wild for two years. I’ve seen email security platforms that let business email compromise attempts straight through because nobody configured them properly and nobody was monitoring the outputs. I’ve seen backup solutions that had never been tested – and when tested, didn’t restore.
In each case, the tool was on the invoice. The protection wasn’t.
Skin in the game
Nassim Taleb – the philosopher and risk theorist whose work partly inspired the name of this business, has a concept he calls skin in the game.
The idea is straightforward. If you give advice without bearing any of the consequences when that advice turns out to be wrong, your advice is essentially worthless. Not necessarily because you’re dishonest, but because you have no mechanism to keep you honest.
Doctors who don’t treat patients. Economists who don’t invest their own money. Consultants who recommend restructuring and then leave before the restructuring happens. Taleb is withering about all of them.
The principle applies directly to cyber security.
If I recommend a tool to a client and that tool fails them – if they get hit, if their data gets stolen, if they can’t recover from a ransomware attack, I don’t just lose a client. I lose my reputation. In Chesterfield and the surrounding area, where I’ve worked for twenty years, reputation is not abstract. It’s the next conversation at a business event. It’s the call from someone who knows someone who knows someone. It’s the review that doesn’t get written because the relationship ended badly.
I have skin in the game. Every recommendation I make has my name on it.
That’s not a marketing line. It changes how I make decisions.
The tools I recommend – and why
I want to be specific, because vague reassurances don’t actually tell you anything.
Huntress – Managed Detection and Response
Huntress is a managed detection and response platform built specifically for small and medium businesses. The reason I use it is straightforward: it finds things that traditional antivirus misses.
Most endpoint protection tools work by comparing files and processes against a database of known threats. If the threat is in the database, it gets flagged. If it isn’t – if it’s a new variant, or a living-off-the-land attack that uses legitimate system tools to move laterally – it doesn’t.
Huntress has a team of human analysts, running around the clock, reviewing alerts and hunting for the kind of low-and-slow activity that automated tools miss. When something suspicious surfaces in a client’s environment, a human looks at it. That matters.
I use Huntress because I’ve seen what it finds that nothing else does. Not in theory – in practice, on real client environments.
It also covers identity threat detection through Microsoft 365 – watching for account compromise, suspicious login patterns, and the early stages of business email compromise that most businesses don’t detect until after money has moved.
Heimdal – Patch Management, DNS Filtering, Privileged Access, NGAV, Ransomware Protection, and MXDR
Heimdal does several things, and I want to be clear about why I chose it rather than assembling separate tools for each function.
Patch management is the unglamorous backbone of security. The majority of successful cyber attacks exploit known vulnerabilities – vulnerabilities that have patches available. The problem is that patching is tedious, disruptive, and easy to defer. Heimdal automates it in a way that’s thorough without being intrusive, and it covers third-party applications, (not just Windows updates), which is where a lot of the real exposure sits.
DNS filtering stops connections to malicious domains before they resolve. Before the malware downloads. Before the phishing page loads. It’s a quiet control that prevents a significant number of incidents from ever becoming incidents.
Privileged access management limits what any given user account can actually do on a system. It’s the principle of least privilege made practical. If a compromised account doesn’t have the rights to install software, disable security tools, or move laterally across the network, an attacker who takes control of that account hits a wall.
Next-generation antivirus (NGAV) goes beyond the signature-based detection that traditional antivirus relies on. Windows Defender is better than nothing. It is not sufficient on its own for a business that holds client data, processes payments, or operates in a regulated sector. Heimdal NGAV uses behavioural analysis and threat intelligence to catch threats that have no prior signature – the kind that legacy tools miss entirely. It also doesn’t require enterprise-level IT to manage, which matters for the businesses I work with.
Ransomware Encryption Protection is a control that I think is genuinely underappreciated. Most antivirus tools try to detect ransomware by recognising the malware itself. Heimdal’s ransomware protection works differently – it monitors for the act of unauthorised file encryption happening in real time and blocks it before files are locked. It’s a last line of defence that works even when the malware itself isn’t recognised. For a care home, a school, or a small manufacturer, the difference between stopping encryption at file one and letting it run for thirty seconds can mean the difference between a minor incident and a catastrophic one.
Heimdal MXDR – Managed Extended Detection and Response, adds a 24/7 human monitoring layer on top of the platform. Real analysts, watching around the clock, investigating alerts and responding to threats. For businesses that don’t have an in-house security team, (which is most of the businesses I work with), this closes the gap between having security tools and having someone actively watching them. An alert that fires at 2am on a Saturday is no use if nobody sees it until Monday morning.
I chose Heimdal because it does all of this in a way that’s manageable for small businesses – not enterprises with dedicated security teams. The interface is clear, the reporting is useful, and the support is responsive. I’ve used alternatives that were better on paper and worse in practice.
Avanan / Check Point Harmony Email
Email is the primary attack vector for most of the businesses I work with. Phishing. Business email compromise. Malicious attachments. Impersonation of suppliers, solicitors and senior staff.
The built-in spam filtering that comes with Microsoft 365 is better than nothing. It is not good enough on its own.
Avanan, now part of Check Point’s Harmony Email product, sits inside the Microsoft 365 environment rather than rerouting mail through an external gateway. This matters because it can analyse emails after Microsoft’s own filters have processed them, catching things that slip through. It also analyses the behavioural patterns of email, not just content, which makes it significantly better at catching zero-day phishing attempts and impersonation attacks that don’t contain overtly malicious links or attachments.
I’ve seen it stop attacks that looked, to a human eye, completely legitimate. That’s the point.
Axcient / ConnectWise Cloud Backup
A backup strategy that hasn’t been tested is not a backup strategy. It’s a feeling.
I’ve seen businesses discover this at the worst possible moment – mid-incident, attempting to restore from a backup that hadn’t completed properly in months, or that had been silently encrypted alongside the live data it was supposed to protect.
Axcient provides immutable, offsite backups with tested recovery. The immutability piece matters: a backup that can be reached and encrypted by ransomware offers no protection at all. Offsite matters too – a local backup doesn’t help if the building floods or the backup server is on the same network as the compromised devices.
I test restores. Not occasionally. Regularly. Because the only thing worse than no backup is a false sense of security from a backup that doesn’t work.
One Thing I’ll Always Be Straight About
No combination of tools can guarantee that every threat will be detected and stopped. Cyber security doesn’t work like that, and anyone telling you it does is not being honest with you.
Attackers are inventive, well-resourced, and constantly evolving. Zero-day vulnerabilities – flaws that have no patch because nobody knows they exist yet, are real. Human error is real. No vendor, however good, can promise perfect detection.
What the right layers do is change what failure looks like. Instead of a catastrophic, business-ending event, you get a contained incident – one you can respond to, recover from, and learn from. Visibility where there was none. A response capability that limits the damage. Backups that actually restore. A cyber insurer who pays out because the controls were in place.
That’s not a consolation prize. For a small business, it’s the difference between closing your doors and carrying on.
I’d rather tell you that upfront than have you find out when it matters.
What I Don’t Do
I don’t take referral fees from vendors for pointing clients their way. I don’t recommend tools because a partner programme offers me better margins on them. I don’t suggest products I haven’t actually used and tested.
I also don’t recommend more than a client needs. There are businesses I work with where a lighter-touch approach is genuinely appropriate for their risk profile, and I tell them that. Overselling security tools to businesses that don’t need them might generate short-term revenue. It doesn’t generate long-term trust.
Taleb’s point about skin in the game isn’t really about honesty. It’s about alignment.
When the person giving you advice bears the same consequences as you do, their interests and yours are aligned. You don’t have to interrogate their motives, because their motives are structurally the same as yours.
That’s what I’m trying to build with every client relationship. Not a vendor relationship. An aligned one.
If you’ve been wondering whether your current security tools are actually protecting you or whether they’re just on an invoice somewhere, I’m happy to have that conversation. No pressure. No pitch. Just an honest look at what you’ve got and whether it’s doing what it’s supposed to do.
