We find the holes before someone else does

Security advice often arrives as a hundred-item checklist with no order to it. We rank risks by how likely they are and how much damage they would do, then fix from the top. For most small and mid-sized businesses the first weeks look similar: turn on multi-factor authentication everywhere, remove old accounts, patch exposed systems, separate guest Wi-Fi from the office network and make sure backups cannot be encrypted by the same attack that hits your servers.

These steps are not glamorous, but they stop the majority of real incidents. Once they are in place, we move on to monitoring, application testing and the controls your sector or customers ask for.

You get a clear record of what we changed and what is still open, so you always know where you stand.

A large client or payment provider sends a security questionnaire, and suddenly it matters. If you take card payments, PCI DSS applies to you whether you process cards in Lagos or London. UK government and many UK supply chains ask for Cyber Essentials. Larger customers increasingly want to see ISO 27001 or progress towards it.

We run a gap analysis against the standard, fix what is missing, write the policies in language your staff will read, and assemble the evidence an auditor will request. We do not certify you ourselves; accredited bodies do that. Our job is to make sure you pass without surprises. Data protection duties under the NDPA, GDPR and UK GDPR are covered along the way, since many of the controls overlap.

Most attacks start with an email. We give staff short, practical training, run phishing simulations and make reporting a suspicious message easy and blame-free. A good security culture costs little and catches what technology misses.

Policies matter here too. We write short documents covering the essentials: acceptable use, passwords and sign-in, handling customer data, remote working and reporting incidents. Each fits on a page or two and uses plain language, because a policy nobody reads protects nobody. New starters get a brief induction, and refresher sessions run through the year, timed around real threats such as invoice fraud and fake delivery messages, which are common in West Africa and the UK alike. Reporting a mistake should never feel like owning up to a crime, so we help managers respond calmly.