For years we've been told that cyberattacks are a big-company problem. The truth is the opposite: SMEs are now among the favorite targets, precisely because they tend to be less protected. The good news is that protecting yourself doesn't require a huge budget or grinding operations to a halt. It requires discipline, judgment, and starting with what genuinely moves the needle.

SMEs are in the crosshairs too

Most attacks aren't sophisticated or targeted: they're automated and looking for the easiest way in. A reused password, an unpatched machine, or a backup no one has ever tested is enough to cause an outage that costs days of work and the trust of your customers.

Protecting yourself isn't about buying the most expensive tool; it's about steadily reducing that exposed surface.

Start with the basics, done well

Before thinking about advanced solutions, it's worth securing the foundations. These are unglamorous measures, but they're the ones that cut risk the most:

Automated backups and, above all, tested ones: a backup that has never been restored isn't a backup, it's a hope.
Access control: each person with their own permissions, two-factor authentication where it matters, and no shared passwords.
Systems and applications kept up to date, which is where most known doors get closed.
Team training: most incidents start with a click, so the best firewall is a workforce that knows what to watch for.

End-to-end protection

On top of that foundation, protection is built in layers: email, devices, network, backups, and monitoring all working together. It's not about stacking up products, but about each layer covering what the previous one can't see, with a realistic view of what to protect first based on each business's actual risk.

Critical systems: keep them running

Many companies have systems that simply can't afford to go down: the ERP, billing, or an IBM iSeries environment that keeps daily operations running. Protecting them doesn't mean tinkering with them needlessly, but locking down their access, securing their backups, and watching their behavior to catch anything out of the ordinary in time.

No hype: measure and improve

Security isn't a certificate you hang on the wall once a year. It's a process. It's worth regularly reviewing what has changed, what new threats have emerged, and which measures are no longer enough. The point isn't to promise that nothing will ever happen, but to be ready so that, if it does, the impact is as small as possible and recovery is fast.

How we approach it at Ecofin

We start by understanding your operation and your critical points, without scaremongering. From there we propose a phased plan, prioritizing what protects the most with the least impact on day-to-day work, and we support you through maintenance so that protection doesn't end up as a snapshot from day one. Realistic security, tailored to your company and designed to keep the business running.