Cyber Health Check
From £285
- Accounts and multi-factor authentication
- Email security
- Devices and updates
- Backups and recovery
- Website basics
- Access and staff practices
- Written prioritised findings
- Walkthrough of the report
Main starting service
Cyber Security Health Check for Small Businesses
A practical review for a business that wants to understand its common cyber risks before they turn into expensive problems. No jargon, no scare tactics, and a clear list of what to do first. Based in Dundee, working with businesses across Scotland and the United Kingdom.
From £285 Starting price. Final cost depends on what the project needs.
Who it is for
Aimed squarely at businesses without an IT department, which is most of them.
- Small and medium businesses with no in-house IT
- Companies asked about security by a client, insurer or tender
- Businesses that have had a near miss
- Owners who suspect things are not quite right but cannot say why
- Anyone whose staff use their own devices for work
- Businesses growing past the point where informal is good enough
What it solves
- No multi-factor authentication on the email everything else resets through
- Shared passwords, or the same one used in several places
- Old staff accounts still active months after they left
- Backups that exist in principle but have never been tested
- Devices missing updates for a year
- No idea what to do first if something went wrong
What can be included
Not every project needs everything here. The scope is agreed before work starts, and the quotation reflects what you actually asked for.
Accounts
- Multi-factor authentication, an extra sign-in check
- Administrator accounts
- Password and access habits
- Who can reach what
Email and devices
- Business email protection
- Account recovery settings
- Updates and security software
- Device access
Backups
- What matters most
- How it is backed up
- Whether recovery has actually been tested
Website and practices
- Website updates and access
- Staff awareness
- Employee access
- Basic incident preparedness
A practical review for a business that wants to understand common cyber risks before they become expensive problems.
What can be reviewed
- Email accounts, recovery settings and multi-factor authentication, which is an extra sign-in check
- Password and account-access habits
- Devices, software updates and administrator access
- Backups, and whether recovery has actually been tested
- The website, its forms and the basics of public trust
- How customer information is handled, and how prepared you are for an incident
What you receive
- A plain-language summary of what is working and what needs attention
- Priorities showing what should be improved first
- Optional support with the improvements you agree to
What you get out of it
- A clear picture of where you actually stand, in writing
- Priorities, so you fix the things that matter first
- Plain English rather than a scanner report
- Something to show a client or insurer who asks
- Most findings cost nothing to fix beyond a bit of time
What you receive
- A written report in plain English, not scanner output
- Every finding rated so you know what matters first
- What is already fine, said explicitly, so you are not sold work you do not need
- A practical action list you can hand to anyone
- A walkthrough conversation once you have read it
- Optional help with the fixes you choose to make
What is needed from you
- A conversation about what the business uses
- Permission in writing for anything being looked at
- Read access where it is genuinely needed, agreed in advance
- Never a password, recovery code or authentication token
Security considered from the start.
The review takes recognised guidance from organisations such as the UK National Cyber Security Centre, OWASP and the ICO into consideration where relevant. Where relevant, development practices take recognised guidance from organisations such as OWASP and the UK National Cyber Security Centre into consideration.
Standards and guidance this work follows
Not a certification claim. These are the published references the work is measured against, so the decisions are somebody else's tested thinking rather than only mine.
National Cyber Security Centre
UK government guidance on small business security, account protection, device management and backups. Used as the reference point for what good practice looks like.
Information Commissioner’s Office
UK data protection guidance. Shapes what a form asks for, how long information is kept, what a privacy notice says, and how cookies are handled.
OWASP
The Open Worldwide Application Security Project. Its guidance on authentication, access control, input validation, session handling and safe error messages informs how anything with a login or a form is built.
Following recognised guidance is not the same as holding an independent certification, and none is claimed here.
How it works
Short conversation
What the business uses, roughly how many people, and what you are worried about. No charge and no obligation.
Agreed scope
What is being reviewed and what is not, written down before anything starts.
Review
The areas above, working with you rather than around you.
Report and walkthrough
Plain-language findings, prioritised, then talked through so you know what to do first.
Pricing
Prices shown are starting prices. Final pricing depends on project requirements, functionality, complexity, integrations and third-party services. A clear quotation is provided before work begins.
Honest scope: this is not full penetration testing, formal Cyber Essentials certification, continuous security monitoring or emergency incident response.
Common questions
What actually happens in a Cyber Health Check?
A conversation, then a structured review of accounts, email, devices, backups, access and the website, then a written report with findings in priority order, then a walkthrough so you understand what matters.
How much of our time does it take?
Usually a couple of short conversations and access to the things being reviewed. A few days end to end for a small business.
Is this Cyber Essentials certification?
No. It is a practical health check, and I am not a Cyber Essentials assessor. It can help you understand where you stand before pursuing certification, and I will say plainly if certification is what you actually need.
Will you ask for our passwords?
No. You will never be asked for passwords, recovery codes or authentication credentials, and you should be suspicious of anyone who does.
We are small. Are we really a target?
Most attacks are not aimed at anyone in particular. They are automated, and they find whatever is reachable and out of date. Being small is not cover.
Do you only work with businesses in Scotland?
No. The business is based in Dundee and works with companies across Scotland and the rest of the United Kingdom. Most of this work happens remotely.
Related services
Find out where you actually stand
A short conversation first, at no cost, so you know whether this is worth doing before committing to anything.